c52f924d3bfb919c333aca8faa1b2f286bd6822d52361536c766105416a1af0b

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22-07-2024 22:26

Target

650a6c9b68f98a36c5b2069e8813f1e4_JaffaCakes118.dll
Size

11KB
MD5

650a6c9b68f98a36c5b2069e8813f1e4
SHA1

6e0ee2cd02f20f4a48a4ecd9e3a8f9e0b4a7ba67
SHA256

c52f924d3bfb919c333aca8faa1b2f286bd6822d52361536c766105416a1af0b
SHA512

0f86beaeaa346eb0a6a8cbb061ea18c9c8620a648e64e2a99982f17f877b526eae862a1bf7dd942779cce77ce195f7dd8dc622eb4ac002068d9e68d25aea1ccc
SSDEEP

192:4XepoNSc57tNnE0eEdMKJCBHafMoAH8biCGDowHHPFBCiGhAzzN9qdHWK0:q8R67tN1mKJuAMoU8biCQopi6DdHg

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 2444	2308	rundll32.exe	28
PID 2308 wrote to memory of 2444	2308	rundll32.exe	28
PID 2308 wrote to memory of 2444	2308	rundll32.exe	28
PID 2308 wrote to memory of 2444	2308	rundll32.exe	28
PID 2308 wrote to memory of 2444	2308	rundll32.exe	28
PID 2308 wrote to memory of 2444	2308	rundll32.exe	28
PID 2308 wrote to memory of 2444	2308	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\650a6c9b68f98a36c5b2069e8813f1e4_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\650a6c9b68f98a36c5b2069e8813f1e4_JaffaCakes118.dll,#1
  2⤵
  PID:2444