77994d28facb7e7e488372d1c067c769d538ba36a5fe2b75158656054f26d7f5

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 01:52

Target

32dc10af86cd0e0578328dc9f36c8254_JaffaCakes118.dll
Size

31KB
MD5

32dc10af86cd0e0578328dc9f36c8254
SHA1

a3f93515256c60a5e8f6edb94eada40e0d419391
SHA256

77994d28facb7e7e488372d1c067c769d538ba36a5fe2b75158656054f26d7f5
SHA512

f7ec6bc9f8270216255beec2206a7565a0c0dd6dbf76cb21258ea6993e2b0c79f2d76c49775300820513fcabc88983dd4f4d266f2f7d81a1fd06f20994294b54
SSDEEP

768:qbJWA1CqWe0PamHQ267tM/AChqDERIEjN7:ckA1kPamM7tEhkYRIEjx

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2536	2372	rundll32.exe	30
PID 2372 wrote to memory of 2536	2372	rundll32.exe	30
PID 2372 wrote to memory of 2536	2372	rundll32.exe	30
PID 2372 wrote to memory of 2536	2372	rundll32.exe	30
PID 2372 wrote to memory of 2536	2372	rundll32.exe	30
PID 2372 wrote to memory of 2536	2372	rundll32.exe	30
PID 2372 wrote to memory of 2536	2372	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\32dc10af86cd0e0578328dc9f36c8254_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\32dc10af86cd0e0578328dc9f36c8254_JaffaCakes118.dll,#1
  2⤵
  PID:2536