2093ef6b82840c3cd2b8fadb582ce6b3b7dd7ee25bd7c291b5122d65433948fe

Analysis

max time kernel
15s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 08:05

Target

3c9779cece9243e1486be3b2698b45fb_JaffaCakes118.dll
Size

112KB
MD5

3c9779cece9243e1486be3b2698b45fb
SHA1

8043f50c4a0611f7d19c27a1b239b25909935bdd
SHA256

2093ef6b82840c3cd2b8fadb582ce6b3b7dd7ee25bd7c291b5122d65433948fe
SHA512

9995df0d8867b90461e2d2b64136b5faebc0b253df980aa3ffdba60293d218f74d94a75cb84511f0c1c7a5572e5bf9720ffbaa8627a20e0a54fa63a74a6f0e02
SSDEEP

3072:5jgOgvOGBdAFp2PDyXJdP+cUa/AYOj+I9yAX1g0uuNmfZOYpWRO:RJX1kRltLyZOY

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 1612	2224	rundll32.exe	29
PID 2224 wrote to memory of 1612	2224	rundll32.exe	29
PID 2224 wrote to memory of 1612	2224	rundll32.exe	29
PID 2224 wrote to memory of 1612	2224	rundll32.exe	29
PID 2224 wrote to memory of 1612	2224	rundll32.exe	29
PID 2224 wrote to memory of 1612	2224	rundll32.exe	29
PID 2224 wrote to memory of 1612	2224	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c9779cece9243e1486be3b2698b45fb_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c9779cece9243e1486be3b2698b45fb_JaffaCakes118.dll,#1
  2⤵
  PID:1612