438127ae4c29bbe63720d594e4c177f6d81f589a8e11b74c99fac5ea8e27a721

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19-07-2024 16:35

Target

5cc1bf0fde5834aa4e6ebd2bb86c45c3_JaffaCakes118.dll
Size

6KB
MD5

5cc1bf0fde5834aa4e6ebd2bb86c45c3
SHA1

d24a57388507afa1d440287d32ead288f3b70207
SHA256

438127ae4c29bbe63720d594e4c177f6d81f589a8e11b74c99fac5ea8e27a721
SHA512

e2785ca6081fc55e62688491c9c0ee92a9ac4883eb51e3ff3cf63bfc2a06be1fcaad4cf793d649d69d8cca393e325b5688fcbccbfbbe7d09ed4c4e941d91cc2b
SSDEEP

96:I2f6AeSlLbTsCM7OrzIl0n+oGtIZoeNyiCEEx/KJ:17bAjO/W0+f47NSfx/

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 2780	2736	rundll32.exe	30
PID 2736 wrote to memory of 2780	2736	rundll32.exe	30
PID 2736 wrote to memory of 2780	2736	rundll32.exe	30
PID 2736 wrote to memory of 2780	2736	rundll32.exe	30
PID 2736 wrote to memory of 2780	2736	rundll32.exe	30
PID 2736 wrote to memory of 2780	2736	rundll32.exe	30
PID 2736 wrote to memory of 2780	2736	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5cc1bf0fde5834aa4e6ebd2bb86c45c3_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5cc1bf0fde5834aa4e6ebd2bb86c45c3_JaffaCakes118.dll,#1
  2⤵
  PID:2780