a75e0459b5331c64153d7bf6c6929202f72845b806e958698515d80a19073995

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 18:29

Target

2b4efdd42d1248e162730976a361c89e_JaffaCakes118.dll
Size

2.2MB
MD5

2b4efdd42d1248e162730976a361c89e
SHA1

80fd94939cb2d000635512a08186904a50f0e618
SHA256

a75e0459b5331c64153d7bf6c6929202f72845b806e958698515d80a19073995
SHA512

1acbbc5f98f02b2f20c764115a130abefc5b228cf3ca4ff7b0eac9121af64176615d48279975146cd9b5195e27ed597122eef20038f661f74bfb38095d5d5f32
SSDEEP

49152:0oWPNvEfZ9H0ueJ0xokREjYaCpkc1/YpduTrEnvRsw:GvEHH5exkREljc1/iuTr

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2168	2248	rundll32.exe	28
PID 2248 wrote to memory of 2168	2248	rundll32.exe	28
PID 2248 wrote to memory of 2168	2248	rundll32.exe	28
PID 2248 wrote to memory of 2168	2248	rundll32.exe	28
PID 2248 wrote to memory of 2168	2248	rundll32.exe	28
PID 2248 wrote to memory of 2168	2248	rundll32.exe	28
PID 2248 wrote to memory of 2168	2248	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b4efdd42d1248e162730976a361c89e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b4efdd42d1248e162730976a361c89e_JaffaCakes118.dll,#1
  2⤵
  PID:2168