e14790c1f6f8dba748fbb96b6fdc5287862a34712e53428c3e45e206eef646e5

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19-07-2024 12:44

Target

5bfea583c121ca718f6417917790dee8_JaffaCakes118.dll
Size

33KB
MD5

5bfea583c121ca718f6417917790dee8
SHA1

ae6a6de4e537cb9416d894f2342e3324f061a521
SHA256

e14790c1f6f8dba748fbb96b6fdc5287862a34712e53428c3e45e206eef646e5
SHA512

8f836ecfea09bf7a0cbc4b2fdfea18a7ca54f5dad6b4943aabb0a5e07ceeaba05bd267676f53fbb8c688a27e5ae72c9b283296918f3e376c93b262bb91e8c747
SSDEEP

768:y2M61pGt+eC8IIklhlM7gQ/WSIUt5hnDus6rRx3NtUw:y25LvSIIkrO7gdS1Xhys6Rx9tr

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 784 wrote to memory of 2944	784	rundll32.exe	31
PID 784 wrote to memory of 2944	784	rundll32.exe	31
PID 784 wrote to memory of 2944	784	rundll32.exe	31
PID 784 wrote to memory of 2944	784	rundll32.exe	31
PID 784 wrote to memory of 2944	784	rundll32.exe	31
PID 784 wrote to memory of 2944	784	rundll32.exe	31
PID 784 wrote to memory of 2944	784	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5bfea583c121ca718f6417917790dee8_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:784
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5bfea583c121ca718f6417917790dee8_JaffaCakes118.dll,#1
  2⤵
  PID:2944