c5c74a3e56f443204b56ad5835ea1fb23f2898744ade6a4a1756d7a366ad5607

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 11:26

Target

38ec18d7c140565632027f2691df2775_JaffaCakes118.dll
Size

72KB
MD5

38ec18d7c140565632027f2691df2775
SHA1

1750ea8eec08352ba956d61db846385f6d95cc30
SHA256

c5c74a3e56f443204b56ad5835ea1fb23f2898744ade6a4a1756d7a366ad5607
SHA512

522e0e0260daf6ade56718c59eff837ecb34f78e6cebeda28a2d44a518f47c0bcd4ba81ebc880dd244a59d8247fe84380e4560c276cc4a0f6a8cc046a2f68f05
SSDEEP

1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuv:C5UOq0ukgOK2l7aFQv

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2776	2348	rundll32.exe	30
PID 2348 wrote to memory of 2776	2348	rundll32.exe	30
PID 2348 wrote to memory of 2776	2348	rundll32.exe	30
PID 2348 wrote to memory of 2776	2348	rundll32.exe	30
PID 2348 wrote to memory of 2776	2348	rundll32.exe	30
PID 2348 wrote to memory of 2776	2348	rundll32.exe	30
PID 2348 wrote to memory of 2776	2348	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\38ec18d7c140565632027f2691df2775_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\38ec18d7c140565632027f2691df2775_JaffaCakes118.dll,#1
  2⤵
  PID:2776