f337d92c2da6c67ab019ed686f14c9e73dc4f13e3b4fb101ed3028f30bfc9ba7

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
23-07-2024 09:08

Target

66f3eb38a9f2d50af3d5e60f935087c6_JaffaCakes118.dll
Size

32KB
MD5

66f3eb38a9f2d50af3d5e60f935087c6
SHA1

5f99a4045b97df001c26d8260be135dd990199f9
SHA256

f337d92c2da6c67ab019ed686f14c9e73dc4f13e3b4fb101ed3028f30bfc9ba7
SHA512

7eea0aa2a25be09ae5792790fb7a7ca792db2c2ad133ea77add45ee1f7d069b1ebeceea848286b1b24eb26051ea7c471896cc8f84e20ec3e331d1c98798205e7
SSDEEP

384:n7NpE1BCFq8ESGIjsYbxsTQP37kK00QsiFVil6JYM8ODe69XTkMD/d+uL:7gL8RLjxbxsTQP37s0Q7U6JYXODddJ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 1824	3000	rundll32.exe	30
PID 3000 wrote to memory of 1824	3000	rundll32.exe	30
PID 3000 wrote to memory of 1824	3000	rundll32.exe	30
PID 3000 wrote to memory of 1824	3000	rundll32.exe	30
PID 3000 wrote to memory of 1824	3000	rundll32.exe	30
PID 3000 wrote to memory of 1824	3000	rundll32.exe	30
PID 3000 wrote to memory of 1824	3000	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\66f3eb38a9f2d50af3d5e60f935087c6_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\66f3eb38a9f2d50af3d5e60f935087c6_JaffaCakes118.dll,#1
  2⤵
  PID:1824