e21f9b8a9a46c2dfc73969590b76d5611d04e7bc7d42678320d4dc2c7a665952

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 22:10

Target

3ae7c9b5d5ac85f16f7674d8c9ba4e45_JaffaCakes118.dll
Size

72KB
MD5

3ae7c9b5d5ac85f16f7674d8c9ba4e45
SHA1

dad0f543ac10f10b43224046e98af7b93b4fcb54
SHA256

e21f9b8a9a46c2dfc73969590b76d5611d04e7bc7d42678320d4dc2c7a665952
SHA512

479e11b20f7755ce4be1b88abbbebd4422007025169e4eb3d73ce59800c75ad9f9cc7e5ed83a27beb71670f70decc9414c2f1373566381bd7f5a51ed600be5f5
SSDEEP

1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuv:C5UOq0ukgOK2l7aFQv

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 1176	1648	rundll32.exe	31
PID 1648 wrote to memory of 1176	1648	rundll32.exe	31
PID 1648 wrote to memory of 1176	1648	rundll32.exe	31
PID 1648 wrote to memory of 1176	1648	rundll32.exe	31
PID 1648 wrote to memory of 1176	1648	rundll32.exe	31
PID 1648 wrote to memory of 1176	1648	rundll32.exe	31
PID 1648 wrote to memory of 1176	1648	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ae7c9b5d5ac85f16f7674d8c9ba4e45_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ae7c9b5d5ac85f16f7674d8c9ba4e45_JaffaCakes118.dll,#1
  2⤵
  PID:1176