118465e961b9003a0f7517f92eae4fc54c55e4b5ad8539792eda71c61b85996a

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22-07-2024 09:46

Target

62bbf86fbbc1c24dd501c8ec429d1f30_JaffaCakes118.dll
Size

72KB
MD5

62bbf86fbbc1c24dd501c8ec429d1f30
SHA1

2197e979e12ca882508ffc62e6acb695b80f1489
SHA256

118465e961b9003a0f7517f92eae4fc54c55e4b5ad8539792eda71c61b85996a
SHA512

2929c10a4a868bbff847c37d0793db2c4bfa3ef10332f119b549e2a33bfa596cabd61a6f39c9f59cb628ec6f1a4832d7bd2da1eb6706abcf0636b1ce7b8aa65d
SSDEEP

1536:/LSeqjziajD3oxPl24OJ69CXDs6LF2JB:AWaf3Kd24264Ts6L4JB

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 2212	1684	rundll32.exe	30
PID 1684 wrote to memory of 2212	1684	rundll32.exe	30
PID 1684 wrote to memory of 2212	1684	rundll32.exe	30
PID 1684 wrote to memory of 2212	1684	rundll32.exe	30
PID 1684 wrote to memory of 2212	1684	rundll32.exe	30
PID 1684 wrote to memory of 2212	1684	rundll32.exe	30
PID 1684 wrote to memory of 2212	1684	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\62bbf86fbbc1c24dd501c8ec429d1f30_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\62bbf86fbbc1c24dd501c8ec429d1f30_JaffaCakes118.dll,#1
  2⤵
  PID:2212