76a81df0cac5425c5bfe18659f81df402ee53c65b8291906f687b9ba2f99cab8

Analysis

max time kernel
120s
max time network
20s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 18:37

Target

42de59832469fd7db7e941c150a3fe18_JaffaCakes118.dll
Size

106KB
MD5

42de59832469fd7db7e941c150a3fe18
SHA1

c684c29d83ab87518b8630adabf48a2e0ce0c7d8
SHA256

76a81df0cac5425c5bfe18659f81df402ee53c65b8291906f687b9ba2f99cab8
SHA512

d357d60adef57bf92fe1cb8298ceb91391288ba4180dc2779d97f62d35c5d1befcf8d748ea2daebedb1ac7a3edede769623ae869ad2fea898a0cc6ece8ef581e
SSDEEP

1536:/MjVneiS/xfv/GK6zDkTGUPIBnS8JN5wL9jFfY9y64zLlUKZwR4GiS8O:EBS/xfHXuDyGVl5wpg4z3qRCO

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 2160	2780	rundll32.exe	30
PID 2780 wrote to memory of 2160	2780	rundll32.exe	30
PID 2780 wrote to memory of 2160	2780	rundll32.exe	30
PID 2780 wrote to memory of 2160	2780	rundll32.exe	30
PID 2780 wrote to memory of 2160	2780	rundll32.exe	30
PID 2780 wrote to memory of 2160	2780	rundll32.exe	30
PID 2780 wrote to memory of 2160	2780	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\42de59832469fd7db7e941c150a3fe18_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\42de59832469fd7db7e941c150a3fe18_JaffaCakes118.dll,#1
  2⤵
  PID:2160