5be6c290b81cb9e16706046d2f6e100e868219eac183373675dfe79f732d13ad

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 04:20

Target

37ae1b98c17179c7ccce520bbf67c68b_JaffaCakes118.dll
Size

32KB
MD5

37ae1b98c17179c7ccce520bbf67c68b
SHA1

476d64ab63d6ea4f16d17164edd19e86e0128f0f
SHA256

5be6c290b81cb9e16706046d2f6e100e868219eac183373675dfe79f732d13ad
SHA512

64b2b17e59edcec06987126db4305b824523356442387b928a2ffde01d2190d0d33435b5ba80e9f9b87766479201f73ca50612bab13cadb5b353bc0314d17bb7
SSDEEP

384:dWRxD56W1rRy2408lh/jkcIRagzN5wj7D77iYfiIuIzawYJFJLCRCkI8a:K1QWtHd8PZIaaN5kD75KINzhqDmRCkIT

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 2492	2808	rundll32.exe	31
PID 2808 wrote to memory of 2492	2808	rundll32.exe	31
PID 2808 wrote to memory of 2492	2808	rundll32.exe	31
PID 2808 wrote to memory of 2492	2808	rundll32.exe	31
PID 2808 wrote to memory of 2492	2808	rundll32.exe	31
PID 2808 wrote to memory of 2492	2808	rundll32.exe	31
PID 2808 wrote to memory of 2492	2808	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\37ae1b98c17179c7ccce520bbf67c68b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\37ae1b98c17179c7ccce520bbf67c68b_JaffaCakes118.dll,#1
  2⤵
  PID:2492