01b1660c2dc01835577a260b5800fbb77583e48139ed81a2b15fa31906f1949a

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 02:59

Target

377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll
Size

97KB
MD5

377337ea24561a8ebdbd56526bb15770
SHA1

53d11d17700e83aaf78f161301c9cdc420d7f8ea
SHA256

01b1660c2dc01835577a260b5800fbb77583e48139ed81a2b15fa31906f1949a
SHA512

a506cbee92194b2d0a8d44ad1a595dee76b1d6d232574de9c8d20acbb2cc7c6882709a429a0a3206774b9f7b5822de6a41fa4f87deb3e90ba2c4430c9927507c
SSDEEP

1536:WFCNy6vQjcIGcE+X1Vgme1tbLlvVXWCF7jMCJAY/2sXTHUDHMBnOh9Vt1uW:hczcg1+ZJvVGEjPA+2s6HduW

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 2400	2544	rundll32.exe	30
PID 2544 wrote to memory of 2400	2544	rundll32.exe	30
PID 2544 wrote to memory of 2400	2544	rundll32.exe	30
PID 2544 wrote to memory of 2400	2544	rundll32.exe	30
PID 2544 wrote to memory of 2400	2544	rundll32.exe	30
PID 2544 wrote to memory of 2400	2544	rundll32.exe	30
PID 2544 wrote to memory of 2400	2544	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#1
  2⤵
  PID:2400