3b431a0e63f9edb5edb6e0d419b309487833bbcff467c8a075d90702d3884ec7

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10-07-2024 21:10

Target

366508fbcaec3b8604a34bfe350b348c_JaffaCakes118.dll
Size

91KB
MD5

366508fbcaec3b8604a34bfe350b348c
SHA1

2d0ea3bac134b8dd81b72e923f42919278929d9b
SHA256

3b431a0e63f9edb5edb6e0d419b309487833bbcff467c8a075d90702d3884ec7
SHA512

1600056b17265a4b412526cfb36b55c426532cc17334ae25fc7482987dfccfc0ee7df35c3b85a23826fa7875d581605d60de681e30b8765145e5267bd32ac1fe
SSDEEP

1536:jpSyrn1CZZV1ErUuXippOn/gtbzMaofbuPgpjIti9wVaPQvC6X91eL:gyLSzErUuy6n/W6lpjIE9w0E1+

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2420 wrote to memory of 1392	2420	rundll32.exe	rundll32.exe
PID 2420 wrote to memory of 1392	2420	rundll32.exe	rundll32.exe
PID 2420 wrote to memory of 1392	2420	rundll32.exe	rundll32.exe
PID 2420 wrote to memory of 1392	2420	rundll32.exe	rundll32.exe
PID 2420 wrote to memory of 1392	2420	rundll32.exe	rundll32.exe
PID 2420 wrote to memory of 1392	2420	rundll32.exe	rundll32.exe
PID 2420 wrote to memory of 1392	2420	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\366508fbcaec3b8604a34bfe350b348c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2420

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\366508fbcaec3b8604a34bfe350b348c_JaffaCakes118.dll,#1
2⤵
PID:1392