533ebe3a1f9734c30db7ce0462ff6366d09c2df3a3c748cfc261fc9bdbbdc24c

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 09:52

Target

66db2090c03e65fc7ffccae8a801b4a6_JaffaCakes118.dll
Size

256KB
MD5

66db2090c03e65fc7ffccae8a801b4a6
SHA1

2369c707ef9c9cba7efd76995e7fcca1bff21ace
SHA256

533ebe3a1f9734c30db7ce0462ff6366d09c2df3a3c748cfc261fc9bdbbdc24c
SHA512

e46318689c5e3e2d8bee07cbf1b5aba99aef026cead2f25100272411eab2f02dcc0dd9011889f3c00ebb4963faed8f37964dca2d8795713afcf3292b039c5c0d
SSDEEP

6144:gMlLg3zG6nqv88Bd9KvxAVXZLEpmSVz/i0Wfk7JEE:XlLeqv88Bd90xmZLrSJ/i0Wfkd

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 1516	2116	rundll32.exe	28
PID 2116 wrote to memory of 1516	2116	rundll32.exe	28
PID 2116 wrote to memory of 1516	2116	rundll32.exe	28
PID 2116 wrote to memory of 1516	2116	rundll32.exe	28
PID 2116 wrote to memory of 1516	2116	rundll32.exe	28
PID 2116 wrote to memory of 1516	2116	rundll32.exe	28
PID 2116 wrote to memory of 1516	2116	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\66db2090c03e65fc7ffccae8a801b4a6_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\66db2090c03e65fc7ffccae8a801b4a6_JaffaCakes118.dll,#1
  2⤵
  PID:1516