c66270c842b26bb3be3c6cffb227dc623129b2505dc99758bf7a2dfb5ca8a745

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 21:36

Target

3ef8f9a6113a776638344ccb8fdce1af_JaffaCakes118.dll
Size

66KB
MD5

3ef8f9a6113a776638344ccb8fdce1af
SHA1

3d9a32ed6f298b6d9da9e7c22e24a720097f005d
SHA256

c66270c842b26bb3be3c6cffb227dc623129b2505dc99758bf7a2dfb5ca8a745
SHA512

c2c30cda8fdbc5524e37217f4deb33df9f0f8d08512bd0f771f5354793fbb1dbedbb2b876554b5ea93bc1d029b411be336c514e59c7ff84d703d11a641966d07
SSDEEP

768:HAVPzAnhYtIvY/09Xa/k1ZfEkO9QNxhJOfLYwLgEnBC/tkeeXfAimUEDgn7GUC3Q:HGzrtIiMjHQfLYwLJnI/tkz1xWy

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 2168	1676	rundll32.exe	30
PID 1676 wrote to memory of 2168	1676	rundll32.exe	30
PID 1676 wrote to memory of 2168	1676	rundll32.exe	30
PID 1676 wrote to memory of 2168	1676	rundll32.exe	30
PID 1676 wrote to memory of 2168	1676	rundll32.exe	30
PID 1676 wrote to memory of 2168	1676	rundll32.exe	30
PID 1676 wrote to memory of 2168	1676	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ef8f9a6113a776638344ccb8fdce1af_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ef8f9a6113a776638344ccb8fdce1af_JaffaCakes118.dll,#1
  2⤵
  PID:2168