1477d758560e3fd6dc5eb80fd0974267bdcba1c616fc10cd30d02bef0d27e9a3

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 17:24

Target

35ada355a0afae28a13b0f4b30afb04e_JaffaCakes118.dll
Size

36KB
MD5

35ada355a0afae28a13b0f4b30afb04e
SHA1

4138a72a211f125ce49cc6735a709c2eb7b3d673
SHA256

1477d758560e3fd6dc5eb80fd0974267bdcba1c616fc10cd30d02bef0d27e9a3
SHA512

527b0eb8762d00e086f579340e8cd256f57a700d39ce1c0defdaa23b14501187a4b6cf2a4ecad8d676fa8b26464212416e0d4d7bfbc73bdb4c07e2b2f7321284
SSDEEP

768:sWtf1lkAzsDbNNO+Ba0Z/7MQiSyCLvH/CODbhTR+6Q:r1lkwK3O4aW7MzSzLvKOhTR+6Q

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 2104	1820	rundll32.exe	30
PID 1820 wrote to memory of 2104	1820	rundll32.exe	30
PID 1820 wrote to memory of 2104	1820	rundll32.exe	30
PID 1820 wrote to memory of 2104	1820	rundll32.exe	30
PID 1820 wrote to memory of 2104	1820	rundll32.exe	30
PID 1820 wrote to memory of 2104	1820	rundll32.exe	30
PID 1820 wrote to memory of 2104	1820	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\35ada355a0afae28a13b0f4b30afb04e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\35ada355a0afae28a13b0f4b30afb04e_JaffaCakes118.dll,#1
  2⤵
  PID:2104