8c1c01f51cdf05ebf0d7a17748990cba28ffb2d506d06ab0b6aa56c2b3760eaf

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 08:04

Target

2e247aa58036f60dea6391ef4a1444f6_JaffaCakes118.dll
Size

16KB
MD5

2e247aa58036f60dea6391ef4a1444f6
SHA1

e41b42c973e8ff423981991a133876e949407965
SHA256

8c1c01f51cdf05ebf0d7a17748990cba28ffb2d506d06ab0b6aa56c2b3760eaf
SHA512

0f36db1a403aa4b3e4d255718c1b769f850ca36cee01a273a89588918b02a9c86dcac1b8435f2db85b64fa4f3ae63e9e09d0332547c84ebc5be315120afb6783
SSDEEP

384:skF53wvnjt5V38HzMxWfBgMdxHLkZl+eBv9B7ieE:s+53kjt5eAQfGMdxHwZl+S9B7LE

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 1312	2240	rundll32.exe	28
PID 2240 wrote to memory of 1312	2240	rundll32.exe	28
PID 2240 wrote to memory of 1312	2240	rundll32.exe	28
PID 2240 wrote to memory of 1312	2240	rundll32.exe	28
PID 2240 wrote to memory of 1312	2240	rundll32.exe	28
PID 2240 wrote to memory of 1312	2240	rundll32.exe	28
PID 2240 wrote to memory of 1312	2240	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e247aa58036f60dea6391ef4a1444f6_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e247aa58036f60dea6391ef4a1444f6_JaffaCakes118.dll,#1
  2⤵
  PID:1312