3d75decec4ce2ed3e01f494dd3fd81659f2343e03a6a9669c763f02735b4be82

Analysis

max time kernel
14s
max time network
20s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 08:09

Target

66c7d50f34c1064f8e4c146dcf793e9c_JaffaCakes118.dll
Size

85KB
MD5

66c7d50f34c1064f8e4c146dcf793e9c
SHA1

19bf9943d21cd064bc180f5286b570caf78c8e6f
SHA256

3d75decec4ce2ed3e01f494dd3fd81659f2343e03a6a9669c763f02735b4be82
SHA512

0726029ebce6ec3e32b409237481b7c2d86ed46a3210a2e105ffb408e8f02dac439621fb4662626fd4c2da19fa32301acc39e90bd3e13c8e142116fe52e7fe8c
SSDEEP

1536:OQQ2STcPPvV1jCB8h8UZbOuVC1+tzEkYVGnDFPC:OQQ2SIXPjCOyYbOuVC1+tbYwDFPC

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 2912	624	rundll32.exe	30
PID 624 wrote to memory of 2912	624	rundll32.exe	30
PID 624 wrote to memory of 2912	624	rundll32.exe	30
PID 624 wrote to memory of 2912	624	rundll32.exe	30
PID 624 wrote to memory of 2912	624	rundll32.exe	30
PID 624 wrote to memory of 2912	624	rundll32.exe	30
PID 624 wrote to memory of 2912	624	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\66c7d50f34c1064f8e4c146dcf793e9c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:624
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\66c7d50f34c1064f8e4c146dcf793e9c_JaffaCakes118.dll,#1
  2⤵
  PID:2912