94e7aa1fb6a977ad8340d2aba14cbbca4787cc9f684a4bc89c7d63aae3fecf60

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 22:25 UTC

Target

3af49093a53092a081446ed8dce5aa20_JaffaCakes118.dll
Size

53KB
MD5

3af49093a53092a081446ed8dce5aa20
SHA1

050cbef07aa12a28dd8ac070e1dc0b4c123350a0
SHA256

94e7aa1fb6a977ad8340d2aba14cbbca4787cc9f684a4bc89c7d63aae3fecf60
SHA512

8bfd4ed350eee6a3a49145524fd45d57727fb48255b3415bee50bc825d24febaabb2c394b0deb0c9111ae56c34cc276e5c8dac95cfa9e2a75bad3c67da397c86
SSDEEP

1536:O4cf6HHZkZRVQxjPHoiHHVwVg4qfCr5dDH2pPjio58tH1XTddj:ZcfCYPQxjQYweJqf2pT58tH1j7j

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 1696	1964	rundll32.exe	30
PID 1964 wrote to memory of 1696	1964	rundll32.exe	30
PID 1964 wrote to memory of 1696	1964	rundll32.exe	30
PID 1964 wrote to memory of 1696	1964	rundll32.exe	30
PID 1964 wrote to memory of 1696	1964	rundll32.exe	30
PID 1964 wrote to memory of 1696	1964	rundll32.exe	30
PID 1964 wrote to memory of 1696	1964	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3af49093a53092a081446ed8dce5aa20_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3af49093a53092a081446ed8dce5aa20_JaffaCakes118.dll,#1
  2⤵
  PID:1696