04f8c190fa2a5d2c5714e5e0a4d0aa381e2c4f85c514542f5db135ea1a4400b8

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 18:12

Target

3e5a632667c43eeacb1924fe55fdc13f_JaffaCakes118.dll
Size

33KB
MD5

3e5a632667c43eeacb1924fe55fdc13f
SHA1

961e3bb981dadc5863c10df4278c9c7d4cd4d145
SHA256

04f8c190fa2a5d2c5714e5e0a4d0aa381e2c4f85c514542f5db135ea1a4400b8
SHA512

d19cee73b7bdf52fa2815344e33f350e257019348e710f26b0315a757c2c89f8bd79cfe6685abd15abbaa1704a7c1db18311dedef0854e80e1d8c9a62a399327
SSDEEP

768:sCpRVdQUaUrHy4Kr/Ai5m7EiEAdMSVOc4RLB85:sCp7dQUaU24KrA7EiEAdV6R0

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 1208	2292	rundll32.exe	30
PID 2292 wrote to memory of 1208	2292	rundll32.exe	30
PID 2292 wrote to memory of 1208	2292	rundll32.exe	30
PID 2292 wrote to memory of 1208	2292	rundll32.exe	30
PID 2292 wrote to memory of 1208	2292	rundll32.exe	30
PID 2292 wrote to memory of 1208	2292	rundll32.exe	30
PID 2292 wrote to memory of 1208	2292	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3e5a632667c43eeacb1924fe55fdc13f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3e5a632667c43eeacb1924fe55fdc13f_JaffaCakes118.dll,#1
  2⤵
  PID:1208