8cfe22f1d949aea76fe0c2a7e028b714c2bf8c2cbc7e56c498b62e45ca54986b

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20-07-2024 05:43

Target

5f3e67c71ebf107fb7a30bce0633525b_JaffaCakes118.dll
Size

55KB
MD5

5f3e67c71ebf107fb7a30bce0633525b
SHA1

825c1b46e42f7bd425ec3ed180f5c1022142af01
SHA256

8cfe22f1d949aea76fe0c2a7e028b714c2bf8c2cbc7e56c498b62e45ca54986b
SHA512

a76bc92eb4cad0dbc0bb0d38bce16ee440f98f6bad9be3e51e9bf0865af2524006c3cba674d2669908293d29585da0b5991d161d76f187dcc539caa2c3568fa5
SSDEEP

768:y1JqF6+akLmJ3/ZqWYfgluyTtugVJ5vdK8X1vmZ1LrIpo9rIDj:yHqF6kU3OoluyTtugNvdKs1o1XCoNIP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2756	3028	rundll32.exe	30
PID 3028 wrote to memory of 2756	3028	rundll32.exe	30
PID 3028 wrote to memory of 2756	3028	rundll32.exe	30
PID 3028 wrote to memory of 2756	3028	rundll32.exe	30
PID 3028 wrote to memory of 2756	3028	rundll32.exe	30
PID 3028 wrote to memory of 2756	3028	rundll32.exe	30
PID 3028 wrote to memory of 2756	3028	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5f3e67c71ebf107fb7a30bce0633525b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5f3e67c71ebf107fb7a30bce0633525b_JaffaCakes118.dll,#1
  2⤵
  PID:2756