6e1313e500f2a55a333a4f7ca31e8a9570887d19a311fba7bef426fbcdeb9cf2

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 04:31

Target

2afcf0c6398f143766fb8cf8bc3dab7d_JaffaCakes118.dll
Size

111KB
MD5

2afcf0c6398f143766fb8cf8bc3dab7d
SHA1

392a29185e788de469b9a0234321d84803813524
SHA256

6e1313e500f2a55a333a4f7ca31e8a9570887d19a311fba7bef426fbcdeb9cf2
SHA512

241fbcebad04c4d1405a72a02267a90394f9dd0652a88e396c04f5263a21471adff0c0b42f82fc456784286cb2b5f195682a69b936ab0bbce254ed0eaf1555f1
SSDEEP

3072:2mpHcmCP9qZffPNrgu9wdV/0wJxpAXRduSRbEtLVj:2+jCYZHPlv9wj0wJxpAXpRbE5x

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 2688	2968	rundll32.exe	30
PID 2968 wrote to memory of 2688	2968	rundll32.exe	30
PID 2968 wrote to memory of 2688	2968	rundll32.exe	30
PID 2968 wrote to memory of 2688	2968	rundll32.exe	30
PID 2968 wrote to memory of 2688	2968	rundll32.exe	30
PID 2968 wrote to memory of 2688	2968	rundll32.exe	30
PID 2968 wrote to memory of 2688	2968	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2afcf0c6398f143766fb8cf8bc3dab7d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2afcf0c6398f143766fb8cf8bc3dab7d_JaffaCakes118.dll,#1
  2⤵
  PID:2688