a3824f60f1ca94bd998273f853e3308f9d5a2e1f6844a85cc6b61d6317360251

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13-07-2024 07:00

Target

40a7123b6cea1041e16bbd76cc2c03c2_JaffaCakes118.dll
Size

70KB
MD5

40a7123b6cea1041e16bbd76cc2c03c2
SHA1

be891adf1ac510cadd1d56b7b982c49a395c9686
SHA256

a3824f60f1ca94bd998273f853e3308f9d5a2e1f6844a85cc6b61d6317360251
SHA512

b21b50d489ec733fc34ccfa9329ff0eee64a924967a90a84d68793114ef00b4414a932c54d40ce70f4b5da238d1a7f2d584fad3b3ec46b918ea91591c2e42adb
SSDEEP

1536:EGlilzZDNFdhWjyZqHqxusfNzPhCM+d6T3LeZFeoDxCn:EGluzZNtWjyGqcczPhbLee2Cn

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 1928	1380	rundll32.exe	30
PID 1380 wrote to memory of 1928	1380	rundll32.exe	30
PID 1380 wrote to memory of 1928	1380	rundll32.exe	30
PID 1380 wrote to memory of 1928	1380	rundll32.exe	30
PID 1380 wrote to memory of 1928	1380	rundll32.exe	30
PID 1380 wrote to memory of 1928	1380	rundll32.exe	30
PID 1380 wrote to memory of 1928	1380	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\40a7123b6cea1041e16bbd76cc2c03c2_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\40a7123b6cea1041e16bbd76cc2c03c2_JaffaCakes118.dll,#1
  2⤵
  PID:1928