63a391583acc840709402da9b03370a2d4501e8582a31123105f3097633172f7

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23-07-2024 14:37

Target

67f835300d6a7a4098ff25d436bc9264_JaffaCakes118.dll
Size

24KB
MD5

67f835300d6a7a4098ff25d436bc9264
SHA1

16470e0ba3b321a9236f6373423a202c29224398
SHA256

63a391583acc840709402da9b03370a2d4501e8582a31123105f3097633172f7
SHA512

290ad7c1f743c2fe38d3a8e9698e728f8ad203063b1deb8420b16c7949470653e5f288fe8fe61f51562ba5699f4869b20dc8d5ea5544ca719465002f47fc1765
SSDEEP

192:asNGS9RWanc9Lht82SrBOUzk9m4VM8GjFVemPej8V1TqMXkOu:acG8W59LhtEQA/4O82FV9PS8Vkwkl

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2996	2912	rundll32.exe	30
PID 2912 wrote to memory of 2996	2912	rundll32.exe	30
PID 2912 wrote to memory of 2996	2912	rundll32.exe	30
PID 2912 wrote to memory of 2996	2912	rundll32.exe	30
PID 2912 wrote to memory of 2996	2912	rundll32.exe	30
PID 2912 wrote to memory of 2996	2912	rundll32.exe	30
PID 2912 wrote to memory of 2996	2912	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\67f835300d6a7a4098ff25d436bc9264_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\67f835300d6a7a4098ff25d436bc9264_JaffaCakes118.dll,#1
  2⤵
  PID:2996