958a91e12942274e1dcd7009f9330ce1c67c50363a8796e975732f647cba2232

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 22:14

Target

369c4ae002f77b402b9007de5976ce72_JaffaCakes118.dll
Size

32KB
MD5

369c4ae002f77b402b9007de5976ce72
SHA1

bdee3731f5b6134be4cdde1de1bce0294259737d
SHA256

958a91e12942274e1dcd7009f9330ce1c67c50363a8796e975732f647cba2232
SHA512

76ae360b52723c43e2645ddc3ac279a7f570f2a3112a274145088c26989443326fbc8e66b98b0be551b4a7b0b10b064fc67b8b7f44f1a4224e1258180e71fe5f
SSDEEP

768:D24K7MjWs6CKSbjsFk+7grzrDN1hVf6ZyZsUr:D24cY5KSs7gHrDrHUyZs8

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 2524	2544	rundll32.exe	30
PID 2544 wrote to memory of 2524	2544	rundll32.exe	30
PID 2544 wrote to memory of 2524	2544	rundll32.exe	30
PID 2544 wrote to memory of 2524	2544	rundll32.exe	30
PID 2544 wrote to memory of 2524	2544	rundll32.exe	30
PID 2544 wrote to memory of 2524	2544	rundll32.exe	30
PID 2544 wrote to memory of 2524	2544	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\369c4ae002f77b402b9007de5976ce72_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\369c4ae002f77b402b9007de5976ce72_JaffaCakes118.dll,#1
  2⤵
  PID:2524