952f3305a1c823f0d91086363145e1552884db0bf553bf3954db65cc211856b1

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 12:58

Target

6344c4a7f258791b5cb9f43248841b37_JaffaCakes118.dll
Size

69KB
MD5

6344c4a7f258791b5cb9f43248841b37
SHA1

3d2af30af64b5f4b15a51876a99042775d537842
SHA256

952f3305a1c823f0d91086363145e1552884db0bf553bf3954db65cc211856b1
SHA512

30615da817e412b74192b310ee32afc8e6bbbaf3ce177b756cc241eea15e740d83f48932a504d6414a4d80f2e297bc23e6ff164591c379a9be6b50c3f148a5fe
SSDEEP

1536:Bm1NGJVGmZs4tt0bBXJsvlmJ/PgvLEDGU8HP4VqMcV0OiIdT7ZXrDuc:kX0VV64YbBZsvsJH6tacV9T7Z7DN

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 2640	3060	rundll32.exe	30
PID 3060 wrote to memory of 2640	3060	rundll32.exe	30
PID 3060 wrote to memory of 2640	3060	rundll32.exe	30
PID 3060 wrote to memory of 2640	3060	rundll32.exe	30
PID 3060 wrote to memory of 2640	3060	rundll32.exe	30
PID 3060 wrote to memory of 2640	3060	rundll32.exe	30
PID 3060 wrote to memory of 2640	3060	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6344c4a7f258791b5cb9f43248841b37_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6344c4a7f258791b5cb9f43248841b37_JaffaCakes118.dll,#1
  2⤵
  PID:2640