777ee5cb3d4250ecf9cb45c640730d52bc586a27566841af301451e1b5dcc706

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22-07-2024 07:30

Target

624c761804260e357a607ddfc88095c5_JaffaCakes118.dll
Size

32KB
MD5

624c761804260e357a607ddfc88095c5
SHA1

b5010af0a84e1ebe166feca82a7ab112348f6fe6
SHA256

777ee5cb3d4250ecf9cb45c640730d52bc586a27566841af301451e1b5dcc706
SHA512

e7692f16d120aa7a5b7b3962c707ee846e321ba99eb8083e98424599289532c3c62482949f04254269c4e4bff898bca295d3686c31cd480876daa07f31a161ea
SSDEEP

768:PkkxDynEfVtVI71szJ776wTPbwzhqDBNRRhXmL:PxDy661sR76wDskTRfXG

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2988	2512	rundll32.exe	31
PID 2512 wrote to memory of 2988	2512	rundll32.exe	31
PID 2512 wrote to memory of 2988	2512	rundll32.exe	31
PID 2512 wrote to memory of 2988	2512	rundll32.exe	31
PID 2512 wrote to memory of 2988	2512	rundll32.exe	31
PID 2512 wrote to memory of 2988	2512	rundll32.exe	31
PID 2512 wrote to memory of 2988	2512	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\624c761804260e357a607ddfc88095c5_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\624c761804260e357a607ddfc88095c5_JaffaCakes118.dll,#1
  2⤵
  PID:2988