e3d67f6c602c2586adb14dc30c5a5297699bc69ef3cda91c5ed1c4c7634cabb6

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 22:25

Target

3f1c9e647e1db4adda35b4596877c70a_JaffaCakes118.dll
Size

299KB
MD5

3f1c9e647e1db4adda35b4596877c70a
SHA1

215f5379e0b17dcf88d71b2d3cc93e4a6beac66a
SHA256

e3d67f6c602c2586adb14dc30c5a5297699bc69ef3cda91c5ed1c4c7634cabb6
SHA512

b81b7e3e62b6620bfaca4281a9f69b492ce98971992e03605f9b946e54d5d37596cacd9047cb4701a155801ec0fcf0e7d9a66e69a776ec5158fbdd21a9c50477
SSDEEP

6144:ZdMJ8kW+AvBMG6G38m4T+9uz6tPjzPPKaGCAzzyRIFxp:y8kW+AeG6GMmhzt0CAvKQ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 2116	2064	rundll32.exe	30
PID 2064 wrote to memory of 2116	2064	rundll32.exe	30
PID 2064 wrote to memory of 2116	2064	rundll32.exe	30
PID 2064 wrote to memory of 2116	2064	rundll32.exe	30
PID 2064 wrote to memory of 2116	2064	rundll32.exe	30
PID 2064 wrote to memory of 2116	2064	rundll32.exe	30
PID 2064 wrote to memory of 2116	2064	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f1c9e647e1db4adda35b4596877c70a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f1c9e647e1db4adda35b4596877c70a_JaffaCakes118.dll,#1
  2⤵
  PID:2116