2f1aaf160e692fc2c496437f6b93502ae9fde2f1223a6189fca4638199b90d3e

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 02:59

Target

023d9e9742a378b55cbd778c66d2e6da_JaffaCakes118.dll
Size

32KB
MD5

023d9e9742a378b55cbd778c66d2e6da
SHA1

9bc221b2545e9103a42ac18c5e199ca8fe683714
SHA256

2f1aaf160e692fc2c496437f6b93502ae9fde2f1223a6189fca4638199b90d3e
SHA512

aee1da53815c8e3017056396ef438b11b598aeac515f7acd68278d5a2172816498d3a39bdfff0c297291e9b4b39c7e2f9e7d48fb6e3faa50578f5b3072ecd777
SSDEEP

768:5bQqCiZHgb+X6glv+CrCgmUSacGo3VBffd6722MDylb0OqOSBRBw:5bhCiZAW6glv+CrCgmUSacGo3VBfQ72u

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 3024	2968	rundll32.exe	28
PID 2968 wrote to memory of 3024	2968	rundll32.exe	28
PID 2968 wrote to memory of 3024	2968	rundll32.exe	28
PID 2968 wrote to memory of 3024	2968	rundll32.exe	28
PID 2968 wrote to memory of 3024	2968	rundll32.exe	28
PID 2968 wrote to memory of 3024	2968	rundll32.exe	28
PID 2968 wrote to memory of 3024	2968	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\023d9e9742a378b55cbd778c66d2e6da_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\023d9e9742a378b55cbd778c66d2e6da_JaffaCakes118.dll,#1
  2⤵
  PID:3024