bbcf0d95b14455d814207c8dbc33b8e86122bd632686bd5917ba3ad5bcb1fa32

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 07:07

Target

669950cd79c017c4b13b4b64d4181eda_JaffaCakes118.dll
Size

33KB
MD5

669950cd79c017c4b13b4b64d4181eda
SHA1

caaa29fa2a186081f4b7fc202cd5080fcf7cff70
SHA256

bbcf0d95b14455d814207c8dbc33b8e86122bd632686bd5917ba3ad5bcb1fa32
SHA512

3731fdd03badd796448a295e4bb1e9e03bf340ebef48a4998aa55bf82e2127dd6dad1228d4051d1ba38d71e3889203f3a73ef36c7f2e3033ee61bb5b8c6c5652
SSDEEP

768:dn5wlHbBOm1e6Y31CLlr7yV7/1GVF5lhCD8ERaoGBG2Dy:x5QNOm16FChS7/1GVFL8QERvGBG2+

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 2200	2976	rundll32.exe	30
PID 2976 wrote to memory of 2200	2976	rundll32.exe	30
PID 2976 wrote to memory of 2200	2976	rundll32.exe	30
PID 2976 wrote to memory of 2200	2976	rundll32.exe	30
PID 2976 wrote to memory of 2200	2976	rundll32.exe	30
PID 2976 wrote to memory of 2200	2976	rundll32.exe	30
PID 2976 wrote to memory of 2200	2976	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\669950cd79c017c4b13b4b64d4181eda_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\669950cd79c017c4b13b4b64d4181eda_JaffaCakes118.dll,#1
  2⤵
  PID:2200