612a8b54a9c6ce93e7d95eccce6db52f58ccfaaf46d7a318f4414c538823abaa

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 10:37

Target

673c6ada6edfd2e1d6786614fd7d07e6_JaffaCakes118.dll
Size

11KB
MD5

673c6ada6edfd2e1d6786614fd7d07e6
SHA1

90c25ba701f67194d3fdf59744c218344710445e
SHA256

612a8b54a9c6ce93e7d95eccce6db52f58ccfaaf46d7a318f4414c538823abaa
SHA512

27cd9544ba4d2ad76f626ee1ce6eea1b65a38ac48d63923106ad63b61fb3efb33b49b250319358e263b8a747ad2e0cba1cb2d73096155ad54676575fd6489905
SSDEEP

192:4JxoNSc57tNnE0eEdMKJCBHafMoAH8biCGDowHHPFBCiGhAzzN9qdHNK0:GR67tN1mKJuAMoU8biCQopi6DdHJ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2376	3032	rundll32.exe	30
PID 3032 wrote to memory of 2376	3032	rundll32.exe	30
PID 3032 wrote to memory of 2376	3032	rundll32.exe	30
PID 3032 wrote to memory of 2376	3032	rundll32.exe	30
PID 3032 wrote to memory of 2376	3032	rundll32.exe	30
PID 3032 wrote to memory of 2376	3032	rundll32.exe	30
PID 3032 wrote to memory of 2376	3032	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\673c6ada6edfd2e1d6786614fd7d07e6_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\673c6ada6edfd2e1d6786614fd7d07e6_JaffaCakes118.dll,#1
  2⤵
  PID:2376