d04c473633eecb20fa7bc6b16ccd64bbc6d01eabdafad003c9ed7769379648e8

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 03:29

Target

3bd658fbbd5d153b45b7e6faa96561ed_JaffaCakes118.dll
Size

208KB
MD5

3bd658fbbd5d153b45b7e6faa96561ed
SHA1

6de81a689f5cdafad7c5f301f7eb5e52342ad3bd
SHA256

d04c473633eecb20fa7bc6b16ccd64bbc6d01eabdafad003c9ed7769379648e8
SHA512

9bf8a89da7f4317652b16c7c8b4e8ee9f809139a4ea589f49acf59fb4409b30e55e3260be6e1bf7c7fe49ee50da363e52054eba4c870545708e99f9c80a7653e
SSDEEP

3072:hcKoxtu4rDdEOrLZ3+1mtqoBAoCI7EunmJKRd82wgiV4MkZc9cJXSQgIICulWWBC:roJf3+1m1CI7E0q4ngIICr

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 1208	2292	rundll32.exe	30
PID 2292 wrote to memory of 1208	2292	rundll32.exe	30
PID 2292 wrote to memory of 1208	2292	rundll32.exe	30
PID 2292 wrote to memory of 1208	2292	rundll32.exe	30
PID 2292 wrote to memory of 1208	2292	rundll32.exe	30
PID 2292 wrote to memory of 1208	2292	rundll32.exe	30
PID 2292 wrote to memory of 1208	2292	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3bd658fbbd5d153b45b7e6faa96561ed_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3bd658fbbd5d153b45b7e6faa96561ed_JaffaCakes118.dll,#1
  2⤵
  PID:1208