3a5a16184cc32559c6f20bf1efa217aeed62330324aa33cd5d1181f28ea39b26

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 15:53

Target

3563d74abc43481c4aa210f7c21dbaf4_JaffaCakes118.dll
Size

130KB
MD5

3563d74abc43481c4aa210f7c21dbaf4
SHA1

0c2d3ba4b831680b85f71091b19d781814ca106f
SHA256

3a5a16184cc32559c6f20bf1efa217aeed62330324aa33cd5d1181f28ea39b26
SHA512

1d7f6aa56c8aa1d4fa19f42a87f21ca373253abf13cc50bb1e67a2ca307559f206406a44af5ba4dfaba4dcaf13b421244128749d8ad5c6bbbf9a3b7920bc1143
SSDEEP

3072:9K0cUX48d+AI4h8vwZoY0HWhNeRFRQJcsm/Tz9lDtTnwg:9ncUIwdVh8vwH0HWSRBsm/Tz9Pr

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 1940	2088	rundll32.exe	30
PID 2088 wrote to memory of 1940	2088	rundll32.exe	30
PID 2088 wrote to memory of 1940	2088	rundll32.exe	30
PID 2088 wrote to memory of 1940	2088	rundll32.exe	30
PID 2088 wrote to memory of 1940	2088	rundll32.exe	30
PID 2088 wrote to memory of 1940	2088	rundll32.exe	30
PID 2088 wrote to memory of 1940	2088	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3563d74abc43481c4aa210f7c21dbaf4_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3563d74abc43481c4aa210f7c21dbaf4_JaffaCakes118.dll,#1
  2⤵
  PID:1940