481c1fba8a8a40a005f4ac0dd54a0809cbd17f232c44431e9a132b582fef739d

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 07:43

Target

2b83d94254c3404452b42b68322c5c87_JaffaCakes118.dll
Size

1019KB
MD5

2b83d94254c3404452b42b68322c5c87
SHA1

9ef2fd5ee9f3bcce25b4914dfa5717378b21f851
SHA256

481c1fba8a8a40a005f4ac0dd54a0809cbd17f232c44431e9a132b582fef739d
SHA512

f26ab1a8ea9596f13b673712cefd287c661c8ae78e7451367fe260c1d62e2676a7713203c447a324fa1d3a4d0355179fdc29536719568a0c7b24fcde9b4b1640
SSDEEP

24576:5EDi+JfnLQh/3l+r7lcPvrBFdDIf+YptI:mfnW/gR4TPK+Yp6

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 2696	2680	rundll32.exe	30
PID 2680 wrote to memory of 2696	2680	rundll32.exe	30
PID 2680 wrote to memory of 2696	2680	rundll32.exe	30
PID 2680 wrote to memory of 2696	2680	rundll32.exe	30
PID 2680 wrote to memory of 2696	2680	rundll32.exe	30
PID 2680 wrote to memory of 2696	2680	rundll32.exe	30
PID 2680 wrote to memory of 2696	2680	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b83d94254c3404452b42b68322c5c87_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b83d94254c3404452b42b68322c5c87_JaffaCakes118.dll,#1
  2⤵
  PID:2696