35c7e9ca2cec155509a03a67e672c39bea058c1858b8752f8f3a38255480ebed

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22-07-2024 13:46

Target

6368d7e4f37695c7519ffcb3f1958ef6_JaffaCakes118.dll
Size

128KB
MD5

6368d7e4f37695c7519ffcb3f1958ef6
SHA1

165015b27ea269c76852c6b155ac7028279d4eac
SHA256

35c7e9ca2cec155509a03a67e672c39bea058c1858b8752f8f3a38255480ebed
SHA512

a65f18a04bb803ad6cf14f2e73aeeebb08b9c1e8db34520f69eec44bec4da709229991bd4d9d0d5b94c10b96bb26b16184c848d5fe63a07c7d08872e363786e9
SSDEEP

3072:J4NLn5ECrxwq4gzgVhaNhfxGaHhBt6FHwjOTU:JYwQzgra/wekFHwqo

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 2688	1980	rundll32.exe	30
PID 1980 wrote to memory of 2688	1980	rundll32.exe	30
PID 1980 wrote to memory of 2688	1980	rundll32.exe	30
PID 1980 wrote to memory of 2688	1980	rundll32.exe	30
PID 1980 wrote to memory of 2688	1980	rundll32.exe	30
PID 1980 wrote to memory of 2688	1980	rundll32.exe	30
PID 1980 wrote to memory of 2688	1980	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6368d7e4f37695c7519ffcb3f1958ef6_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6368d7e4f37695c7519ffcb3f1958ef6_JaffaCakes118.dll,#1
  2⤵
  PID:2688