3b009c6a4f205d1037dd1f08bcc30ef9a34e12c048815693e7747fa6a9b6e7c5

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 20:58

Target

3edbe6fddfe4cb597ec0a30be09bc013_JaffaCakes118.dll
Size

137KB
MD5

3edbe6fddfe4cb597ec0a30be09bc013
SHA1

902dd3ab4188ea4902c030dbc4605ec3b7a195e0
SHA256

3b009c6a4f205d1037dd1f08bcc30ef9a34e12c048815693e7747fa6a9b6e7c5
SHA512

2bddc560d77e675b47644090ad430c307938b22815bbf0eafc8daa9d8049025fc98b95f7332e7937f6ca3a428265f2b2e794e2db8724e31a74c21ea9ac0096b7
SSDEEP

3072:IWp36jFpsIuo3c1OK+yBaMm31obl4vZwgmvchZ7lWz90+4W0:IWpKjzuo3vMpblFOMzu33

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2524	2080	rundll32.exe	30
PID 2080 wrote to memory of 2524	2080	rundll32.exe	30
PID 2080 wrote to memory of 2524	2080	rundll32.exe	30
PID 2080 wrote to memory of 2524	2080	rundll32.exe	30
PID 2080 wrote to memory of 2524	2080	rundll32.exe	30
PID 2080 wrote to memory of 2524	2080	rundll32.exe	30
PID 2080 wrote to memory of 2524	2080	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3edbe6fddfe4cb597ec0a30be09bc013_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3edbe6fddfe4cb597ec0a30be09bc013_JaffaCakes118.dll,#1
  2⤵
  PID:2524