56e3f4343528b9386ff02ec1bcf2087c6ddd5926a8e0333bb1c1429a6847d266

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 02:48

Target

3fe4cf271f3cce719cdc5738c7702442_JaffaCakes118.dll
Size

520KB
MD5

3fe4cf271f3cce719cdc5738c7702442
SHA1

2fb5782b7844ea7f6347fdf55cd55f025fd1c8dc
SHA256

56e3f4343528b9386ff02ec1bcf2087c6ddd5926a8e0333bb1c1429a6847d266
SHA512

2ab6560215e08e8822f4a76cc40f44a3ce79e40b4060e4cf79a1bcdc945bc27d96a9627c090825bcb3c40c2440cd15ceffb053475aaa3adb98f989a24fbdd257
SSDEEP

12288:Muy8vP5ZFCedOlG4nl+lAzFgaRBRHFofzR3Y:XX3bctg44c5BRHFOVo

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 896	2392	rundll32.exe	30
PID 2392 wrote to memory of 896	2392	rundll32.exe	30
PID 2392 wrote to memory of 896	2392	rundll32.exe	30
PID 2392 wrote to memory of 896	2392	rundll32.exe	30
PID 2392 wrote to memory of 896	2392	rundll32.exe	30
PID 2392 wrote to memory of 896	2392	rundll32.exe	30
PID 2392 wrote to memory of 896	2392	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3fe4cf271f3cce719cdc5738c7702442_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3fe4cf271f3cce719cdc5738c7702442_JaffaCakes118.dll,#1
  2⤵
  PID:896