0c8d4aa2e929f39e5149b82e51bd1994e5f368f0adc012825452590cf21aea9e

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
05/07/2024, 00:08

Target

26bfcf2be9ca0118dc5509a2429e1c03_JaffaCakes118.dll
Size

62KB
MD5

26bfcf2be9ca0118dc5509a2429e1c03
SHA1

32b29be62cdb04d510b8f362d29595913e983d43
SHA256

0c8d4aa2e929f39e5149b82e51bd1994e5f368f0adc012825452590cf21aea9e
SHA512

bad7e408bbb834722116a298835558916beebc23d20c3d50bfc160cfded338fa9f5e05d921dc0f4bbe8e08657ffdbd96f8d343629c9c543f6ed4812852663f17
SSDEEP

1536:+VZmwSbI1aF7gr2wwMEoI4b++Wmc0SP+6B7OgQjzwA:KkwSbI1q7IooI4b+7PFPBxo3

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 2532	2116	rundll32.exe	30
PID 2116 wrote to memory of 2532	2116	rundll32.exe	30
PID 2116 wrote to memory of 2532	2116	rundll32.exe	30
PID 2116 wrote to memory of 2532	2116	rundll32.exe	30
PID 2116 wrote to memory of 2532	2116	rundll32.exe	30
PID 2116 wrote to memory of 2532	2116	rundll32.exe	30
PID 2116 wrote to memory of 2532	2116	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\26bfcf2be9ca0118dc5509a2429e1c03_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\26bfcf2be9ca0118dc5509a2429e1c03_JaffaCakes118.dll,#1
  2⤵
  PID:2532