0f690ff2622d2286a3cf33c9dfe09848ac26c3749d46c80e401e1174ade4c336

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21-07-2024 20:16

Target

613f1ce2b8c1ae4cd7ae0941753e1808_JaffaCakes118.dll
Size

33KB
MD5

613f1ce2b8c1ae4cd7ae0941753e1808
SHA1

71f74e569e2e14aa517f07e45030c4938d212277
SHA256

0f690ff2622d2286a3cf33c9dfe09848ac26c3749d46c80e401e1174ade4c336
SHA512

f9caf614153538895dd7065f132fa2a2e45323a7f1b184fa9f67b319649ba988cb35ef85beb17727114f2cbfd501bb5d07a7b40ed741c5faf97b063806e98dbe
SSDEEP

768:7JTzSwGuNNz5bZuV4MUtN1H3XQN70EDR8JnhYDuRoUsJ1p:7FHdMUNXXo70gR8p+KRoJJz

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 2696	1924	rundll32.exe	31
PID 1924 wrote to memory of 2696	1924	rundll32.exe	31
PID 1924 wrote to memory of 2696	1924	rundll32.exe	31
PID 1924 wrote to memory of 2696	1924	rundll32.exe	31
PID 1924 wrote to memory of 2696	1924	rundll32.exe	31
PID 1924 wrote to memory of 2696	1924	rundll32.exe	31
PID 1924 wrote to memory of 2696	1924	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\613f1ce2b8c1ae4cd7ae0941753e1808_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\613f1ce2b8c1ae4cd7ae0941753e1808_JaffaCakes118.dll,#1
  2⤵
  PID:2696