9d6ce232694fe7fe272db5ab7779c94f88e66366cf680d58b9337d223b903da2

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 05:12

Target

2b19010bf9e7e48fca676f44b6079a7c_JaffaCakes118.dll
Size

26KB
MD5

2b19010bf9e7e48fca676f44b6079a7c
SHA1

a434f7d9c02ba1cf3ba7a98b78fc81e1c7520ee1
SHA256

9d6ce232694fe7fe272db5ab7779c94f88e66366cf680d58b9337d223b903da2
SHA512

eebbeb94d532787dd1dfea21500e2fd86bc63d8643808ccd08ee525a5bac5fb75cbe83716c5846282c216262797b4b413be0da1fa812b2a52ecb437c4c690afe
SSDEEP

384:N+lB56BZJJRV0I0jd6iBtu8AedaV4aK5w2zSNOSquBBQARQkpuuibRVmTq0:N+P5IJHVeNaKEftBBQARQkp6bRVmT

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 1748	2536	rundll32.exe	30
PID 2536 wrote to memory of 1748	2536	rundll32.exe	30
PID 2536 wrote to memory of 1748	2536	rundll32.exe	30
PID 2536 wrote to memory of 1748	2536	rundll32.exe	30
PID 2536 wrote to memory of 1748	2536	rundll32.exe	30
PID 2536 wrote to memory of 1748	2536	rundll32.exe	30
PID 2536 wrote to memory of 1748	2536	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b19010bf9e7e48fca676f44b6079a7c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b19010bf9e7e48fca676f44b6079a7c_JaffaCakes118.dll,#1
  2⤵
  PID:1748