0201617b0df2696bf8af849b62f129833e20b5d7a8f2dccfb5ed35ac1fb4e2b1

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22-07-2024 17:09

Target

640c2187c195290962b5b1584ff63cbe_JaffaCakes118.dll
Size

31KB
MD5

640c2187c195290962b5b1584ff63cbe
SHA1

e7c0343da9473c465e04c682100c0aa0a73d3d56
SHA256

0201617b0df2696bf8af849b62f129833e20b5d7a8f2dccfb5ed35ac1fb4e2b1
SHA512

ef5711ac60e074594dabb4b7f4c08a053a9e6d5c241cc3f00ad80f83ff4a7f708a5643138c858d69486fcef5c5eec283f5764c5bfe141ca4cb00570d60b6f6c9
SSDEEP

768:qOJWA1CqWe0PamHQ267tM/AChqDERIEmguf:VkA1kPamM7tEhkYRIEte

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 1792	2448	rundll32.exe	30
PID 2448 wrote to memory of 1792	2448	rundll32.exe	30
PID 2448 wrote to memory of 1792	2448	rundll32.exe	30
PID 2448 wrote to memory of 1792	2448	rundll32.exe	30
PID 2448 wrote to memory of 1792	2448	rundll32.exe	30
PID 2448 wrote to memory of 1792	2448	rundll32.exe	30
PID 2448 wrote to memory of 1792	2448	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\640c2187c195290962b5b1584ff63cbe_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\640c2187c195290962b5b1584ff63cbe_JaffaCakes118.dll,#1
  2⤵
  PID:1792