96f5d1e5b141b64c3ae9d594725b50e33fc328ea7081d0caabdc00a3432341ab

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 03:56

Target

2ae4f38aaef3c7b67550fc43b8daa038_JaffaCakes118.dll
Size

51KB
MD5

2ae4f38aaef3c7b67550fc43b8daa038
SHA1

0804005fbfc0022a2d6c83e1c612c9c3b56f618a
SHA256

96f5d1e5b141b64c3ae9d594725b50e33fc328ea7081d0caabdc00a3432341ab
SHA512

15b097a6172ea5eea3df3b6e4777b4b97146c05eac696cd618152b85ff37b658d24ce4b93fb006ebe09b40dec495b0d2be33148b4a705d2f5afce692adc26ede
SSDEEP

768:SQXX1NLlbizsU9t0S6B8LbRJlk7eeSpeqz4FFj501Zn:SufYt0S6B8ZkQeyYFGn

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2332	2912	rundll32.exe	30
PID 2912 wrote to memory of 2332	2912	rundll32.exe	30
PID 2912 wrote to memory of 2332	2912	rundll32.exe	30
PID 2912 wrote to memory of 2332	2912	rundll32.exe	30
PID 2912 wrote to memory of 2332	2912	rundll32.exe	30
PID 2912 wrote to memory of 2332	2912	rundll32.exe	30
PID 2912 wrote to memory of 2332	2912	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ae4f38aaef3c7b67550fc43b8daa038_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ae4f38aaef3c7b67550fc43b8daa038_JaffaCakes118.dll,#1
  2⤵
  PID:2332