638eddc66cd85b189373a0d337e9a517cea7b1082fdab692a04bcc28c788fd69

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21-07-2024 20:47

Target

61569ed80bbe24f3a828904b450f37e1_JaffaCakes118.dll
Size

97KB
MD5

61569ed80bbe24f3a828904b450f37e1
SHA1

e1370bac54b618c9da38190959be5304c2456676
SHA256

638eddc66cd85b189373a0d337e9a517cea7b1082fdab692a04bcc28c788fd69
SHA512

d8e75b72c74070b63e82f3dbad41c334a44e0b0fa435dd2e7049a50485a25dc747db07b492e931748eccf7facfbf2ec07b7fd744dd492e57d6c98937475101df
SSDEEP

1536:br4fNOY6BkjH7V7JvyZOd3eEofNorAn91n53fxYGm8l0+8w5QPnxwS:b8f89G5ZyZm3097+F82w5QvS

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2524	2080	rundll32.exe	30
PID 2080 wrote to memory of 2524	2080	rundll32.exe	30
PID 2080 wrote to memory of 2524	2080	rundll32.exe	30
PID 2080 wrote to memory of 2524	2080	rundll32.exe	30
PID 2080 wrote to memory of 2524	2080	rundll32.exe	30
PID 2080 wrote to memory of 2524	2080	rundll32.exe	30
PID 2080 wrote to memory of 2524	2080	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\61569ed80bbe24f3a828904b450f37e1_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\61569ed80bbe24f3a828904b450f37e1_JaffaCakes118.dll,#1
  2⤵
  PID:2524