d416148982e7ea32a9899ee01c9840358fcfe39fcbd5747c978fd23ee69d2c89

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 21:04

Target

3ab47ca66b9305648461b69520eef777_JaffaCakes118.dll
Size

101KB
MD5

3ab47ca66b9305648461b69520eef777
SHA1

6d1b36ee35e2d514968baa16191d133f5e6647ee
SHA256

d416148982e7ea32a9899ee01c9840358fcfe39fcbd5747c978fd23ee69d2c89
SHA512

2ee02daffc1663752fe2e75681200ed580d74fd73a66e191ca2f3f765ebdcfdbaa2066362fc9eb43c50a03df51bdf773b68f3a743527b1982f3f40fd1cca5279
SSDEEP

1536:47tCr4fRbd/yAJK1L8GoiqeBCJ4jPERbSQZgCIFm8ymk8D/fCXXUBH9C:4ZO4Rd/yv8GoZegvVSbymnDSnyHs

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 1072	2068	rundll32.exe	30
PID 2068 wrote to memory of 1072	2068	rundll32.exe	30
PID 2068 wrote to memory of 1072	2068	rundll32.exe	30
PID 2068 wrote to memory of 1072	2068	rundll32.exe	30
PID 2068 wrote to memory of 1072	2068	rundll32.exe	30
PID 2068 wrote to memory of 1072	2068	rundll32.exe	30
PID 2068 wrote to memory of 1072	2068	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ab47ca66b9305648461b69520eef777_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ab47ca66b9305648461b69520eef777_JaffaCakes118.dll,#1
  2⤵
  PID:1072