62118b644632fc70f17a31da255e4d902d3e32b33c43c6adf90493d24203d96c

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 22:17

Target

6030f407bebaa4b294f834aad9bcfc65_JaffaCakes118.dll
Size

12KB
MD5

6030f407bebaa4b294f834aad9bcfc65
SHA1

d9e53bc19abaf68a50a7233a246f4d8c73c4833b
SHA256

62118b644632fc70f17a31da255e4d902d3e32b33c43c6adf90493d24203d96c
SHA512

17968f0407e063cd16c31b8b0c8fed25e90bd18ed8b35c5eb5a5aaab718280944a9554e00a60041546970b135ea61cb24cfda1514d35ca416a3df8bb4a6fde84
SSDEEP

192:3S2mwTqxZ2bA6CPssa0g6UoMslGST3OYgQ6kuTzDpr1o3X+8qmKb6q:i+TCZ2c9ssvg6UoMslhK9r1Yuh6q

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 816	2632	rundll32.exe	31
PID 2632 wrote to memory of 816	2632	rundll32.exe	31
PID 2632 wrote to memory of 816	2632	rundll32.exe	31
PID 2632 wrote to memory of 816	2632	rundll32.exe	31
PID 2632 wrote to memory of 816	2632	rundll32.exe	31
PID 2632 wrote to memory of 816	2632	rundll32.exe	31
PID 2632 wrote to memory of 816	2632	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6030f407bebaa4b294f834aad9bcfc65_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6030f407bebaa4b294f834aad9bcfc65_JaffaCakes118.dll,#1
  2⤵
  PID:816