c32cd7988188222701d82e102cd66fbe93534e4cea891e7a3e04d0301ef553f3

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 01:22

Target

06c635879bd2def77e64fcd6c77886ac_JaffaCakes118.dll
Size

119KB
MD5

06c635879bd2def77e64fcd6c77886ac
SHA1

c311c0ad6940db5e9fc6cc09a15cdab085f843ba
SHA256

c32cd7988188222701d82e102cd66fbe93534e4cea891e7a3e04d0301ef553f3
SHA512

b4494406ae6724af6cfd2d9ec35033dd4088470068b7f5d30b3dfc02839dc3dc873f1b564c56b1d514fb2ae3cc2ed7cd8a9ba278e0a407ccc40b5af8cb3c993b
SSDEEP

3072:uA4JUnUyYPV1SdeH3ZczDSOGu9zbD+ideDLJF:SWnUWdeHKvlzP+WeDLf

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 1896	2208	rundll32.exe	28
PID 2208 wrote to memory of 1896	2208	rundll32.exe	28
PID 2208 wrote to memory of 1896	2208	rundll32.exe	28
PID 2208 wrote to memory of 1896	2208	rundll32.exe	28
PID 2208 wrote to memory of 1896	2208	rundll32.exe	28
PID 2208 wrote to memory of 1896	2208	rundll32.exe	28
PID 2208 wrote to memory of 1896	2208	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\06c635879bd2def77e64fcd6c77886ac_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\06c635879bd2def77e64fcd6c77886ac_JaffaCakes118.dll,#1
  2⤵
  PID:1896