1d67dd23c17b0314a51c7570c1c6337b21d1dc5ad4373c9b67edca6f158b90a1

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 17:12

Target

3a07e976ec5d0b203e3b5e4021c2744c_JaffaCakes118.dll
Size

34KB
MD5

3a07e976ec5d0b203e3b5e4021c2744c
SHA1

71add3d21209790eea2ce545217f2fc0a5d62c66
SHA256

1d67dd23c17b0314a51c7570c1c6337b21d1dc5ad4373c9b67edca6f158b90a1
SHA512

80ac19e3bf2b27e2bf68e14ea764fd697363355456888490e4ddb3a937420245fbfbb61fcd23f91a71901d71b4bc5c55690c7b6cd1f9783a90a1069229487a59
SSDEEP

768:mlOTjhcY4591BlnONd7hFyDhChw59FR6Cjf:mlOTL45jy7hF4M6XFR6Cj

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 1724	3056	rundll32.exe	31
PID 3056 wrote to memory of 1724	3056	rundll32.exe	31
PID 3056 wrote to memory of 1724	3056	rundll32.exe	31
PID 3056 wrote to memory of 1724	3056	rundll32.exe	31
PID 3056 wrote to memory of 1724	3056	rundll32.exe	31
PID 3056 wrote to memory of 1724	3056	rundll32.exe	31
PID 3056 wrote to memory of 1724	3056	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a07e976ec5d0b203e3b5e4021c2744c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a07e976ec5d0b203e3b5e4021c2744c_JaffaCakes118.dll,#1
  2⤵
  PID:1724