c855562a0e4faee5dd5a5d4c290dd7574770c9d6be3337465ff382cb5e42b8cf

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 01:11

Target

3f9b712be290d666c5242b4d22c274a1_JaffaCakes118.dll
Size

68KB
MD5

3f9b712be290d666c5242b4d22c274a1
SHA1

2f6af2b9fb80af0c3ec8ff2b29ab7d5ca9d25ef5
SHA256

c855562a0e4faee5dd5a5d4c290dd7574770c9d6be3337465ff382cb5e42b8cf
SHA512

311cb0f57b5b8f7df34d7d0771eb442da5952d151ebaaa0b5fe033a84afb52be2420beebd607b3b96e729539fc771c67aae1511367609dc59745e19baf84f9b9
SSDEEP

1536:jhT8neDbzaHOA/NMCyK54EqHhZnnkaE4i/:lT4syOoOnKFqBWh/

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2276	2360	rundll32.exe	30
PID 2360 wrote to memory of 2276	2360	rundll32.exe	30
PID 2360 wrote to memory of 2276	2360	rundll32.exe	30
PID 2360 wrote to memory of 2276	2360	rundll32.exe	30
PID 2360 wrote to memory of 2276	2360	rundll32.exe	30
PID 2360 wrote to memory of 2276	2360	rundll32.exe	30
PID 2360 wrote to memory of 2276	2360	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f9b712be290d666c5242b4d22c274a1_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f9b712be290d666c5242b4d22c274a1_JaffaCakes118.dll,#1
  2⤵
  PID:2276