32f85acf285abece0d89fbc40fc5e02bca8bc4e77108b4308d0759ea322dc78b

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 10:23

Target

2982515be99d26b39484c9a2bf79c683_JaffaCakes118.dll
Size

110KB
MD5

2982515be99d26b39484c9a2bf79c683
SHA1

b4857a24e39a5d1bf45f910cbe85f99ebba95067
SHA256

32f85acf285abece0d89fbc40fc5e02bca8bc4e77108b4308d0759ea322dc78b
SHA512

4063aba9865599abd55c403be508cafd730dc78a2d0fb62f20c5a690371acb374f33dabf131924fadb588cae8f9e44e68d33557646164d6a874acd058d570c79
SSDEEP

1536:eGuqy609pY/xnhBbgA6UVe8GXZAGggQPcnbLIlV+pzlVWM0f9fpzXEgMr/825ub6:Pu0cY/Vhi8MZJiOElkn0F1X92z

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 1444	2348	rundll32.exe	28
PID 2348 wrote to memory of 1444	2348	rundll32.exe	28
PID 2348 wrote to memory of 1444	2348	rundll32.exe	28
PID 2348 wrote to memory of 1444	2348	rundll32.exe	28
PID 2348 wrote to memory of 1444	2348	rundll32.exe	28
PID 2348 wrote to memory of 1444	2348	rundll32.exe	28
PID 2348 wrote to memory of 1444	2348	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2982515be99d26b39484c9a2bf79c683_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2982515be99d26b39484c9a2bf79c683_JaffaCakes118.dll,#1
  2⤵
  PID:1444