24060931cf47b985e97f53cc546c4953d134b9964f56971fafd2c624fac007bb

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 14:14

Target

3db5f47b7a9845db50971509a3aa37c1_JaffaCakes118.dll
Size

72KB
MD5

3db5f47b7a9845db50971509a3aa37c1
SHA1

9ed831555253bb743393a4881bce778ff998efce
SHA256

24060931cf47b985e97f53cc546c4953d134b9964f56971fafd2c624fac007bb
SHA512

d5f3867261d50f6ade0c6f3db7c5216b4696f4d90e1f911eb9c1efe9da51cd4478713c4d65c7f2424feedaa92aca32d089eeed1562fa4cf46b65fd64e8b9ff33
SSDEEP

1536:be3WupZW+EPV67JiszkTmiTXPgF9jKoL48lrF:be3o+EwQszw7PgrjKoL48lrF

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2220	2212	rundll32.exe	31
PID 2212 wrote to memory of 2220	2212	rundll32.exe	31
PID 2212 wrote to memory of 2220	2212	rundll32.exe	31
PID 2212 wrote to memory of 2220	2212	rundll32.exe	31
PID 2212 wrote to memory of 2220	2212	rundll32.exe	31
PID 2212 wrote to memory of 2220	2212	rundll32.exe	31
PID 2212 wrote to memory of 2220	2212	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3db5f47b7a9845db50971509a3aa37c1_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3db5f47b7a9845db50971509a3aa37c1_JaffaCakes118.dll,#1
  2⤵
  PID:2220