978c22c375eed8ad54305304d7a6a64cc8e779609dc9a37a5885e34d89586dfd

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 17:38

Target

64231f0f3f0316ac9c6aef8aea27cb01_JaffaCakes118.dll
Size

65KB
MD5

64231f0f3f0316ac9c6aef8aea27cb01
SHA1

cb2460f82d00ac97e0a51dcbef0bbaded263f5e3
SHA256

978c22c375eed8ad54305304d7a6a64cc8e779609dc9a37a5885e34d89586dfd
SHA512

8a6ffeec32df7f6ec973840dc655445fea5e815b9e9ae8187ee21a2ebeea29f43e6918458d6aa38026f6d9c0159e83d544e4f61837a1b57b179e872bfec8bac0
SSDEEP

1536:SskNTnYQzkuvliN+9sdYhfv3rkT+za16/rWmE9dT:S1TnY4kclz9sdO/o9dT

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 1644	1172	rundll32.exe	31
PID 1172 wrote to memory of 1644	1172	rundll32.exe	31
PID 1172 wrote to memory of 1644	1172	rundll32.exe	31
PID 1172 wrote to memory of 1644	1172	rundll32.exe	31
PID 1172 wrote to memory of 1644	1172	rundll32.exe	31
PID 1172 wrote to memory of 1644	1172	rundll32.exe	31
PID 1172 wrote to memory of 1644	1172	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\64231f0f3f0316ac9c6aef8aea27cb01_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\64231f0f3f0316ac9c6aef8aea27cb01_JaffaCakes118.dll,#1
  2⤵
  PID:1644