2c33ffd7d15297cddb7b93155847d2616d21a5db479dede08a502aa23304849f

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
06-07-2024 15:32

Target

28aa550f0f4837b58471a72b33ce9caf_JaffaCakes118.dll
Size

32KB
MD5

28aa550f0f4837b58471a72b33ce9caf
SHA1

f01ad4ac1dcf3bbff44f6792569db11f81308bcc
SHA256

2c33ffd7d15297cddb7b93155847d2616d21a5db479dede08a502aa23304849f
SHA512

2b583001e3550d9e9d1cf53890ce0bc0135658b331e27bb5dc3a4bfe8e9f4feca8fe4411506b02eec4602cee62c92d24584e810203d2b9ef722e4bd7c1085ff4
SSDEEP

768:Kg/qQ5tk1RdmvWw7Ot+1kjWNqOmESRnZ+9b:Kg/D5a7dmX7OtUu3RZ+5

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2200	2368	rundll32.exe	30
PID 2368 wrote to memory of 2200	2368	rundll32.exe	30
PID 2368 wrote to memory of 2200	2368	rundll32.exe	30
PID 2368 wrote to memory of 2200	2368	rundll32.exe	30
PID 2368 wrote to memory of 2200	2368	rundll32.exe	30
PID 2368 wrote to memory of 2200	2368	rundll32.exe	30
PID 2368 wrote to memory of 2200	2368	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\28aa550f0f4837b58471a72b33ce9caf_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\28aa550f0f4837b58471a72b33ce9caf_JaffaCakes118.dll,#1
  2⤵
  PID:2200