c3f362ce59f793eb7d55f407678bc6a883eb68932a513ad3bd6221f05800f2ad

Analysis

max time kernel
18s
max time network
19s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 10:40

Target

38c6fb661d99afc350099ec1282d7744_JaffaCakes118.dll
Size

212KB
MD5

38c6fb661d99afc350099ec1282d7744
SHA1

326f13d2ffc77214a3178f7d0246d73903a756ac
SHA256

c3f362ce59f793eb7d55f407678bc6a883eb68932a513ad3bd6221f05800f2ad
SHA512

61a8fbd5599c53371e33f6b3861c3e94cc7de553e1f640e25b1dc011b0a44250dd389ebe71d5880b9f10d06974bb89456283fce1d030ae15fda2b3777d014c89
SSDEEP

3072:xhC9ctbCQKHOpniJUChN0FI/7O4JgM2CR2G9cJxSS0T+qlmFW:LnbKKiBhN0FIzVmBOS0yG

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 1052	1596	rundll32.exe	29
PID 1596 wrote to memory of 1052	1596	rundll32.exe	29
PID 1596 wrote to memory of 1052	1596	rundll32.exe	29
PID 1596 wrote to memory of 1052	1596	rundll32.exe	29
PID 1596 wrote to memory of 1052	1596	rundll32.exe	29
PID 1596 wrote to memory of 1052	1596	rundll32.exe	29
PID 1596 wrote to memory of 1052	1596	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\38c6fb661d99afc350099ec1282d7744_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\38c6fb661d99afc350099ec1282d7744_JaffaCakes118.dll,#1
  2⤵
  PID:1052