0059bf23501ba7cdb6bb43a3f9f7b7a37a474f3f5df922a624d4ce3568ababba

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22-07-2024 11:02

Target

62f97033817065dcf430836b9a6a27e8_JaffaCakes118.dll
Size

424KB
MD5

62f97033817065dcf430836b9a6a27e8
SHA1

fef9b377054b3bf42c045f88fcc42fbaaa62a5cc
SHA256

0059bf23501ba7cdb6bb43a3f9f7b7a37a474f3f5df922a624d4ce3568ababba
SHA512

4635a0cd197cf20215052ac08b033e361b05c680db1902166775e6a407697d6454916d136e481b28d2f22bde47aff247dc037dea5777929020685b2a7da09d0f
SSDEEP

6144:Ltbk3Rm+XS0wMyTwSnOI0vgJR2XDhRnrEH/QzuNIoLMVcp267CkTJj:Lta4znOI0vgJR2XlRnrEH/tgcnbJ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 3004	2988	rundll32.exe	31
PID 2988 wrote to memory of 3004	2988	rundll32.exe	31
PID 2988 wrote to memory of 3004	2988	rundll32.exe	31
PID 2988 wrote to memory of 3004	2988	rundll32.exe	31
PID 2988 wrote to memory of 3004	2988	rundll32.exe	31
PID 2988 wrote to memory of 3004	2988	rundll32.exe	31
PID 2988 wrote to memory of 3004	2988	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\62f97033817065dcf430836b9a6a27e8_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\62f97033817065dcf430836b9a6a27e8_JaffaCakes118.dll,#1
  2⤵
  PID:3004