2d73853649e3b03c30ddf536ec929ca4d57a6a0cd4026cb76b38764c19029dc4

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 13:07

Target

393dcf5c6f82a13f9ea5903d3d4534fd_JaffaCakes118.dll
Size

35KB
MD5

393dcf5c6f82a13f9ea5903d3d4534fd
SHA1

7d7eac316f12c780ee1c893a9add6ba805baa92d
SHA256

2d73853649e3b03c30ddf536ec929ca4d57a6a0cd4026cb76b38764c19029dc4
SHA512

f5066421271837d2c824e6c516fa46a36e5c4af4ecbaf1d22841e371113be67b96e1368376230757d0ddb25f520fed020c194ef38a4b2fa5b59197460696ef8f
SSDEEP

384:exw6CL9YMSyIS8st4rVUyzWTNk2/HysQgD77+6HTHICawCJFX9W+RkhfODhi:eHCSyIS1t4j2Z/tD7zH8ChwZ9vRAv

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 1888	2280	rundll32.exe	31
PID 2280 wrote to memory of 1888	2280	rundll32.exe	31
PID 2280 wrote to memory of 1888	2280	rundll32.exe	31
PID 2280 wrote to memory of 1888	2280	rundll32.exe	31
PID 2280 wrote to memory of 1888	2280	rundll32.exe	31
PID 2280 wrote to memory of 1888	2280	rundll32.exe	31
PID 2280 wrote to memory of 1888	2280	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\393dcf5c6f82a13f9ea5903d3d4534fd_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\393dcf5c6f82a13f9ea5903d3d4534fd_JaffaCakes118.dll,#1
  2⤵
  PID:1888