eb87737df62fa325fd5d97e0bcc266ae240759ca180cbd22bdad3d98946e9b73

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 17:47

Target

3a24f7925c13607f090b87661d038fff_JaffaCakes118.dll
Size

126KB
MD5

3a24f7925c13607f090b87661d038fff
SHA1

8144abc3e574b9c0387347ff1a54e97f5cd521f5
SHA256

eb87737df62fa325fd5d97e0bcc266ae240759ca180cbd22bdad3d98946e9b73
SHA512

3f0099f71287a5f4846b0f8867f463f09697220391a65ea89d6677493a401402cbbfb92286a58460286a14c6a9c9cf7e73e94f3e135796437f2f1506f556e0d7
SSDEEP

3072:P/GYCn9x2obI8t1ZVHR0lNnWVIRdYxSgK/:XGYC9xJIw1ZhOPnt0xSgK/

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 2624	1488	rundll32.exe	31
PID 1488 wrote to memory of 2624	1488	rundll32.exe	31
PID 1488 wrote to memory of 2624	1488	rundll32.exe	31
PID 1488 wrote to memory of 2624	1488	rundll32.exe	31
PID 1488 wrote to memory of 2624	1488	rundll32.exe	31
PID 1488 wrote to memory of 2624	1488	rundll32.exe	31
PID 1488 wrote to memory of 2624	1488	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a24f7925c13607f090b87661d038fff_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a24f7925c13607f090b87661d038fff_JaffaCakes118.dll,#1
  2⤵
  PID:2624