d5281d543ae427f7b2960b2f99e4a2c2ece25186fe9c0da8bc0119c0148ee75f

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 22:14

Target

602f1201269dce02a2dcf3164dfef7c9_JaffaCakes118.dll
Size

44KB
MD5

602f1201269dce02a2dcf3164dfef7c9
SHA1

f31de5f62991ac71caa4f9ee9339e016c679376c
SHA256

d5281d543ae427f7b2960b2f99e4a2c2ece25186fe9c0da8bc0119c0148ee75f
SHA512

a1db0a127f8bd5d03513eba2cf8c1eab35038347e72f19461f0a20cc94cdad7f5e2787e6e9d7f8dc4bf1369415b217a0ca16b0d3d397ad2aab8fc324959229f7
SSDEEP

384:ngUgzMT17YMsoUKrP9Uv3723DMsrV31JySnmgZyulgN995BH:iwT17YP49Uv3kD9Dxm8ypr

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 2708	2656	rundll32.exe	30
PID 2656 wrote to memory of 2708	2656	rundll32.exe	30
PID 2656 wrote to memory of 2708	2656	rundll32.exe	30
PID 2656 wrote to memory of 2708	2656	rundll32.exe	30
PID 2656 wrote to memory of 2708	2656	rundll32.exe	30
PID 2656 wrote to memory of 2708	2656	rundll32.exe	30
PID 2656 wrote to memory of 2708	2656	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\602f1201269dce02a2dcf3164dfef7c9_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\602f1201269dce02a2dcf3164dfef7c9_JaffaCakes118.dll,#1
  2⤵
  PID:2708