3b4f626678680ad7bbe93039bf993d66b1a266dbd4bd81bb118b1d504350f270

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
12-07-2024 08:18

Target

3ca1938cd393ad28242d3d21fea3f5d6_JaffaCakes118.dll
Size

24KB
MD5

3ca1938cd393ad28242d3d21fea3f5d6
SHA1

a9d2e31a042391bc98f03005391875d5dab86770
SHA256

3b4f626678680ad7bbe93039bf993d66b1a266dbd4bd81bb118b1d504350f270
SHA512

0bb1323331bd0cf5683df032ce9d41e149bf48e59e06df19bfc12d4edac0343fad3169e4c77e35977b4d75034e9ce73e80a0fc897e2344539a33296958a2f120
SSDEEP

384:XSpfuOX2wsIcRfhqjQOjBq4Mpct5TGGgGu+BGR:XECLaHBq1at5TGvGuKG

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2132	2196	rundll32.exe	30
PID 2196 wrote to memory of 2132	2196	rundll32.exe	30
PID 2196 wrote to memory of 2132	2196	rundll32.exe	30
PID 2196 wrote to memory of 2132	2196	rundll32.exe	30
PID 2196 wrote to memory of 2132	2196	rundll32.exe	30
PID 2196 wrote to memory of 2132	2196	rundll32.exe	30
PID 2196 wrote to memory of 2132	2196	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ca1938cd393ad28242d3d21fea3f5d6_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ca1938cd393ad28242d3d21fea3f5d6_JaffaCakes118.dll,#1
  2⤵
  PID:2132