a851dd558b1d529c662c106bd690cc618976a2a041c917c3210b575738f0b876

Analysis

max time kernel
120s
max time network
131s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 20:50

Target

3aaafeb98137efe247c4ebbab65c58e8_JaffaCakes118.dll
Size

141KB
MD5

3aaafeb98137efe247c4ebbab65c58e8
SHA1

8c2a90349bfb376efb4160e4c75e7dfdf2a3d99a
SHA256

a851dd558b1d529c662c106bd690cc618976a2a041c917c3210b575738f0b876
SHA512

15634b5f25ce44f43a5fd405d33369a864df5a9f5d5a18d4b0b7676747c7cefe52c579bb0319d27a30db86f5b9cdda3e06ae809d8f9e94fa5f5cbc0f439c90c6
SSDEEP

3072:1ECAJhkdOP17s/qaOi08OwyHxcnZGCCXl11PllV1V:1EvgOP17s/F08OaoCC1vl1V

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2160	1992	rundll32.exe	30
PID 1992 wrote to memory of 2160	1992	rundll32.exe	30
PID 1992 wrote to memory of 2160	1992	rundll32.exe	30
PID 1992 wrote to memory of 2160	1992	rundll32.exe	30
PID 1992 wrote to memory of 2160	1992	rundll32.exe	30
PID 1992 wrote to memory of 2160	1992	rundll32.exe	30
PID 1992 wrote to memory of 2160	1992	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3aaafeb98137efe247c4ebbab65c58e8_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3aaafeb98137efe247c4ebbab65c58e8_JaffaCakes118.dll,#1
  2⤵
  PID:2160