9372bf941e95286c5ef19537d54f86f998b0e9c8cb55f1acf6ead990f7bb6664

Analysis

max time kernel
15s
max time network
18s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 19:40

Target

31b598b8ba8ec853d5ddd7b67d425618_JaffaCakes118.dll
Size

92KB
MD5

31b598b8ba8ec853d5ddd7b67d425618
SHA1

f6476aa6399fd3a0acd46e3c2ec1f1d8355ec3d4
SHA256

9372bf941e95286c5ef19537d54f86f998b0e9c8cb55f1acf6ead990f7bb6664
SHA512

e1667d4d92576464f0d70b3e3f668b46e4d6f1263a53aece813297c2a2af7291f39db0a451cc3f0c30e7589099658d8b4dbb5583a83b40692ffb91c4eac7363e
SSDEEP

1536:fSQhBxT9gaYLelXQkjztDKme8+kyloOaIuxzEKneqFK1ajmAFbWYtALieISFjPn7:f5B9O4ntDKme8+kCGwKneqFK1ajmAFbs

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 2128	2052	rundll32.exe	30
PID 2052 wrote to memory of 2128	2052	rundll32.exe	30
PID 2052 wrote to memory of 2128	2052	rundll32.exe	30
PID 2052 wrote to memory of 2128	2052	rundll32.exe	30
PID 2052 wrote to memory of 2128	2052	rundll32.exe	30
PID 2052 wrote to memory of 2128	2052	rundll32.exe	30
PID 2052 wrote to memory of 2128	2052	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\31b598b8ba8ec853d5ddd7b67d425618_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\31b598b8ba8ec853d5ddd7b67d425618_JaffaCakes118.dll,#1
  2⤵
  PID:2128