263b41b2207fc1f853e49037cc2d7815389a54215a7c17df08f801796c42dcef

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 13:22

Target

394b7c1f6dfec9421a3ae17e7fcf297d_JaffaCakes118.dll
Size

439KB
MD5

394b7c1f6dfec9421a3ae17e7fcf297d
SHA1

4e99b5c9be27179bb3fb7644e7d46622eac9ee08
SHA256

263b41b2207fc1f853e49037cc2d7815389a54215a7c17df08f801796c42dcef
SHA512

d8ceea00205fbbaa0340f25b03cd028c894d8f0e87e2d635fcd6f6b3c006f5bc1119b3f48460ba40133938e05875e9a745055462a79ec6a302317c181ddb8131
SSDEEP

6144:L+KaitHHTEHJaoTaBkOIGjI9hXcjsU0dOl9Qp4OVZQ:iKaiRoHJdTCcGjI9hbX4OVZQ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 2788	2056	rundll32.exe	30
PID 2056 wrote to memory of 2788	2056	rundll32.exe	30
PID 2056 wrote to memory of 2788	2056	rundll32.exe	30
PID 2056 wrote to memory of 2788	2056	rundll32.exe	30
PID 2056 wrote to memory of 2788	2056	rundll32.exe	30
PID 2056 wrote to memory of 2788	2056	rundll32.exe	30
PID 2056 wrote to memory of 2788	2056	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\394b7c1f6dfec9421a3ae17e7fcf297d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\394b7c1f6dfec9421a3ae17e7fcf297d_JaffaCakes118.dll,#1
  2⤵
  PID:2788