6ff0a289634c6db0b780c143d18070956caa2db749592c45580e51ba1a858a75

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 14:59

Target

3535e452d0b887eef37930d422aa34d4_JaffaCakes118.dll
Size

248KB
MD5

3535e452d0b887eef37930d422aa34d4
SHA1

ad278bdc0abebe8d1133f07ca5b1219796d23750
SHA256

6ff0a289634c6db0b780c143d18070956caa2db749592c45580e51ba1a858a75
SHA512

59e4a6da5e8bb728f714da578ea5080b436466e28472fd371d6c1383a5f20002ea457f24ffbad5da554921a2c8a2b6a9d89f0e42249c711345b7b07957af667d
SSDEEP

3072:82LNM7l+is9PzqaKRGNyWmArtIEboLYoFrNhjliYBtWrmIG/uru/CNxHLlNP4k1B:fL+cis9bqvWmASEbfIrBImIGKu/cTN

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 2884	2864	rundll32.exe	30
PID 2864 wrote to memory of 2884	2864	rundll32.exe	30
PID 2864 wrote to memory of 2884	2864	rundll32.exe	30
PID 2864 wrote to memory of 2884	2864	rundll32.exe	30
PID 2864 wrote to memory of 2884	2864	rundll32.exe	30
PID 2864 wrote to memory of 2884	2864	rundll32.exe	30
PID 2864 wrote to memory of 2884	2864	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3535e452d0b887eef37930d422aa34d4_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3535e452d0b887eef37930d422aa34d4_JaffaCakes118.dll,#1
  2⤵
  PID:2884