c31faa97d477ade828f32220b76131c2a91cd0a99add8506d39c0dccc91b538d

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 14:37

Target

42184403e921614e0e210d8cd2d9e20f_JaffaCakes118.dll
Size

8KB
MD5

42184403e921614e0e210d8cd2d9e20f
SHA1

591e34626eb663ce35fb206a93231acd2940fdd7
SHA256

c31faa97d477ade828f32220b76131c2a91cd0a99add8506d39c0dccc91b538d
SHA512

ad8fb650a2420d0d0492e813b7a53e587df1b4cd7535122ac25ee9220b424de1455564e4faf7c81f6f70669c55ce983aec2233e562d4ffc97348d3e35100e924
SSDEEP

96:ITByInNTCdUDbGL4XfrUSJ+s2/qpgf3X3X3diHtn2GPH8FixzOTCR:NInNTCdUDbGIfrJ+sGCgF8nZPDzOTC

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2340	2168	rundll32.exe	30
PID 2168 wrote to memory of 2340	2168	rundll32.exe	30
PID 2168 wrote to memory of 2340	2168	rundll32.exe	30
PID 2168 wrote to memory of 2340	2168	rundll32.exe	30
PID 2168 wrote to memory of 2340	2168	rundll32.exe	30
PID 2168 wrote to memory of 2340	2168	rundll32.exe	30
PID 2168 wrote to memory of 2340	2168	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\42184403e921614e0e210d8cd2d9e20f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\42184403e921614e0e210d8cd2d9e20f_JaffaCakes118.dll,#1
  2⤵
  PID:2340