d1e8e8fa4c35315a0bedb5fc2573f780e04cd5bbc14fabb14a262b137a0c7c34

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09-07-2024 18:49

Target

318c823024e80b9078a4e9f2b2f8c2fc_JaffaCakes118.dll
Size

174KB
MD5

318c823024e80b9078a4e9f2b2f8c2fc
SHA1

1e52b9ead419cc2ff0f8804d1b085c891463777f
SHA256

d1e8e8fa4c35315a0bedb5fc2573f780e04cd5bbc14fabb14a262b137a0c7c34
SHA512

8c6863dd1315a18e631dd702e289a08e2a3a6d96901a962b40366e6365fc6ecce91daa1edd585b7637691ab3c325b620dc490f79a030e7f6fac813c78b7efab6
SSDEEP

1536:91moQj+PGsGxPe7iGZQAbPVkbMeWCkglT/BpnayY896GWdLkAWWZz5f/lGuDXsRk:jmoQjEiGZZLgJnG8dWxlbsqsRFW

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 3048	3032	rundll32.exe	30
PID 3032 wrote to memory of 3048	3032	rundll32.exe	30
PID 3032 wrote to memory of 3048	3032	rundll32.exe	30
PID 3032 wrote to memory of 3048	3032	rundll32.exe	30
PID 3032 wrote to memory of 3048	3032	rundll32.exe	30
PID 3032 wrote to memory of 3048	3032	rundll32.exe	30
PID 3032 wrote to memory of 3048	3032	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\318c823024e80b9078a4e9f2b2f8c2fc_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\318c823024e80b9078a4e9f2b2f8c2fc_JaffaCakes118.dll,#1
  2⤵
  PID:3048