d072e1f656b1eb28f392739aaa35d1c9d665c71b757c7f06115915d233fd639d

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 20:27

Target

64aefef610718b294203ae2956254c01_JaffaCakes118.dll
Size

312KB
MD5

64aefef610718b294203ae2956254c01
SHA1

c8ef50708bec760f0f9683d21f9cdb3456298b0f
SHA256

d072e1f656b1eb28f392739aaa35d1c9d665c71b757c7f06115915d233fd639d
SHA512

11f6cb8fd4d4826a0b27922cdada2dd5179f9e927fb2303677684bfcf089b3a756cbcc0e3c6d9517e2daeb82880cc2af2fc27d0e30e171288c5fb6af26ec26df
SSDEEP

3072:QVBuza6k99TrJeRA3iO3iL24Qf5JQ3vWjWHpcE7x8rADTDA4W0kJPoFwfVGrFwQH:QVwza6E9TYqy9QB0OILXaVWwQ+5odS

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 1796	2676	rundll32.exe	30
PID 2676 wrote to memory of 1796	2676	rundll32.exe	30
PID 2676 wrote to memory of 1796	2676	rundll32.exe	30
PID 2676 wrote to memory of 1796	2676	rundll32.exe	30
PID 2676 wrote to memory of 1796	2676	rundll32.exe	30
PID 2676 wrote to memory of 1796	2676	rundll32.exe	30
PID 2676 wrote to memory of 1796	2676	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\64aefef610718b294203ae2956254c01_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\64aefef610718b294203ae2956254c01_JaffaCakes118.dll,#1
  2⤵
  PID:1796