5848cdabfe459d9dec0925d76977e50e814f7780206fc77a1b141958a3e03f52

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 11:33

Target

38f23927071e592e6eeb925ada3f1707_JaffaCakes118.dll
Size

9KB
MD5

38f23927071e592e6eeb925ada3f1707
SHA1

a318e862357b4abe98348750cfda93df4d9adfcd
SHA256

5848cdabfe459d9dec0925d76977e50e814f7780206fc77a1b141958a3e03f52
SHA512

5e4049076af3b9f4d54bb96b87979ba295f71d14658ac2111e2f897acfaccb792aedceb4b97e6a4e56763a69c243c4a7f974aceab248d2bee9c354e02a7bf269
SSDEEP

192:6aypygh2lXPA8PR1QaOVT6ETWiRTWbZwNB8aw:6aAygwlfAQPOVRWiRTWbZwcV

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 332 wrote to memory of 2340	332	rundll32.exe	31
PID 332 wrote to memory of 2340	332	rundll32.exe	31
PID 332 wrote to memory of 2340	332	rundll32.exe	31
PID 332 wrote to memory of 2340	332	rundll32.exe	31
PID 332 wrote to memory of 2340	332	rundll32.exe	31
PID 332 wrote to memory of 2340	332	rundll32.exe	31
PID 332 wrote to memory of 2340	332	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\38f23927071e592e6eeb925ada3f1707_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:332
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\38f23927071e592e6eeb925ada3f1707_JaffaCakes118.dll,#1
  2⤵
  PID:2340