083979772d7a390e57771e2ea1d1c0779ac5f5bae9994069a538ac50e13bee30

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 14:17

Target

6381a8840da5799dc5327e7df6f256ab_JaffaCakes118.dll
Size

56KB
MD5

6381a8840da5799dc5327e7df6f256ab
SHA1

3538a579f94f800193fdb304ddb36e127d5a4db5
SHA256

083979772d7a390e57771e2ea1d1c0779ac5f5bae9994069a538ac50e13bee30
SHA512

7003a621061d82daa98232e9adb11d25d44a75c96a23f3e52cfeae2d7910e9d6a2dec4d59799d799b9047529ceebe12ba172cd0f5f663fba7a675234a35d2dd2
SSDEEP

1536:l+ItUAg0Y+WiABVQohIpNhqCdP84iODD7a8CTb:riAm+WiABeohIpNnva8CTb

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 3020	3016	rundll32.exe	30
PID 3016 wrote to memory of 3020	3016	rundll32.exe	30
PID 3016 wrote to memory of 3020	3016	rundll32.exe	30
PID 3016 wrote to memory of 3020	3016	rundll32.exe	30
PID 3016 wrote to memory of 3020	3016	rundll32.exe	30
PID 3016 wrote to memory of 3020	3016	rundll32.exe	30
PID 3016 wrote to memory of 3020	3016	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6381a8840da5799dc5327e7df6f256ab_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6381a8840da5799dc5327e7df6f256ab_JaffaCakes118.dll,#1
  2⤵
  PID:3020