f59070c1123c91b05b01540317c8fc9402c13b1b76886e6c20369e6e8e9e58ef

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 03:15

Target

3ff8928e0eb6bf44ea500c8bcb1d6833_JaffaCakes118.dll
Size

33KB
MD5

3ff8928e0eb6bf44ea500c8bcb1d6833
SHA1

774b1c65d453eae9b73397d872e07c5f019e4c1e
SHA256

f59070c1123c91b05b01540317c8fc9402c13b1b76886e6c20369e6e8e9e58ef
SHA512

35a3409a5a059404c7bd45fe39d9eeb44231c3a091f0ad3de526b1336d17a894073a7bd52ccbdb23a3e0e5bdc933935f4d9e557ed52dc179d2de90640dbf8d54
SSDEEP

768:cyjqbwgm5Mo+osMe9978+F4yrS6f+UURZu/dB4hzgtwVoFp:hjqXbn8+qP6f3Bgwmw

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 2348	2344	rundll32.exe	31
PID 2344 wrote to memory of 2348	2344	rundll32.exe	31
PID 2344 wrote to memory of 2348	2344	rundll32.exe	31
PID 2344 wrote to memory of 2348	2344	rundll32.exe	31
PID 2344 wrote to memory of 2348	2344	rundll32.exe	31
PID 2344 wrote to memory of 2348	2344	rundll32.exe	31
PID 2344 wrote to memory of 2348	2344	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ff8928e0eb6bf44ea500c8bcb1d6833_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ff8928e0eb6bf44ea500c8bcb1d6833_JaffaCakes118.dll,#1
  2⤵
  PID:2348