be23aa4d943675996e284707eab99865be7ec7b59aa911fccc2a875df27b73bc

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 03:06

Target

20e05cf40e13cd9d61e7bf94960f8df9_JaffaCakes118.dll
Size

18KB
MD5

20e05cf40e13cd9d61e7bf94960f8df9
SHA1

ac72508b708c704f16670de8fef171ff428beb44
SHA256

be23aa4d943675996e284707eab99865be7ec7b59aa911fccc2a875df27b73bc
SHA512

7f2d0676c9250bc119f45005590559591597b53a77acd319501948bbc0b7490245cfcdadea1f0e4de1e94c456a271dd66e2f6827c3d9bb45b3a4b1266846c434
SSDEEP

384:nRdCyfMqlW2mQmjNyTo63Eo7vuor26g5AzXglf:/CyUqlvmQAIb37XxgmQl

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 2184	2880	rundll32.exe	28
PID 2880 wrote to memory of 2184	2880	rundll32.exe	28
PID 2880 wrote to memory of 2184	2880	rundll32.exe	28
PID 2880 wrote to memory of 2184	2880	rundll32.exe	28
PID 2880 wrote to memory of 2184	2880	rundll32.exe	28
PID 2880 wrote to memory of 2184	2880	rundll32.exe	28
PID 2880 wrote to memory of 2184	2880	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\20e05cf40e13cd9d61e7bf94960f8df9_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\20e05cf40e13cd9d61e7bf94960f8df9_JaffaCakes118.dll,#1
  2⤵
  PID:2184