aeee801bf6248e6bc6ad836b11c59b67bf4c4a478e6f362a514e56153ad8c8c3

Analysis

max time kernel
16s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 01:13

Target

3726d8c7eec746ab4f09c7c57ed52ad0_JaffaCakes118.dll
Size

162KB
MD5

3726d8c7eec746ab4f09c7c57ed52ad0
SHA1

69e5005ed78bc154f809afffd468a14e744d0d99
SHA256

aeee801bf6248e6bc6ad836b11c59b67bf4c4a478e6f362a514e56153ad8c8c3
SHA512

9bf94ec6ec26f65eb5d5850784b9859fd7aa607703436fef5b5bd38a224034bc55458ee190bea715ebc754b11b2d5599edc716b3bd42ff55a1cff06204279ecc
SSDEEP

1536:CzYqX3yK1nVWC86c1ha32hHrHvpdmWfmdrOBjBx6KBQK46Llrn+bHm:CzY/ePDGhaEHyWfOSHxNsWKG

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 1332	1768	rundll32.exe	30
PID 1768 wrote to memory of 1332	1768	rundll32.exe	30
PID 1768 wrote to memory of 1332	1768	rundll32.exe	30
PID 1768 wrote to memory of 1332	1768	rundll32.exe	30
PID 1768 wrote to memory of 1332	1768	rundll32.exe	30
PID 1768 wrote to memory of 1332	1768	rundll32.exe	30
PID 1768 wrote to memory of 1332	1768	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3726d8c7eec746ab4f09c7c57ed52ad0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3726d8c7eec746ab4f09c7c57ed52ad0_JaffaCakes118.dll,#1
  2⤵
  PID:1332