2b8c606fb94351e012265f06a14d607e1483559e90d79fa3e88affc564e38dc6

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 23:33

Target

23dc6b00c667c35b2ef148cb89d88044_JaffaCakes118.dll
Size

168KB
MD5

23dc6b00c667c35b2ef148cb89d88044
SHA1

9930cc2da5e137b9547013439a66126814b8fe7f
SHA256

2b8c606fb94351e012265f06a14d607e1483559e90d79fa3e88affc564e38dc6
SHA512

fce4827f438084fd8156b14d5b4ab26331e1564e1b69c413140993271bd3081a337df919de8446f11d512672a4563383c7eb372cf2ae4179847c8578d0aabfe8
SSDEEP

1536:cA+59ThMvknNHjWaysTNr52AdTWyObELQeFdW1d+4YjalslFolctsnb/Lngntlby:zvknNDWkH2OTXKs5dWP+4ikcCb/LgD

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 2892	624	rundll32.exe	28
PID 624 wrote to memory of 2892	624	rundll32.exe	28
PID 624 wrote to memory of 2892	624	rundll32.exe	28
PID 624 wrote to memory of 2892	624	rundll32.exe	28
PID 624 wrote to memory of 2892	624	rundll32.exe	28
PID 624 wrote to memory of 2892	624	rundll32.exe	28
PID 624 wrote to memory of 2892	624	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\23dc6b00c667c35b2ef148cb89d88044_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:624
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\23dc6b00c667c35b2ef148cb89d88044_JaffaCakes118.dll,#1
  2⤵
  PID:2892