b08d9ea7448561e8a9ae66b789b1a8fcca7adc26e9fa3d33359ff57727bbde5e

Analysis

max time kernel
15s
max time network
18s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 09:49

Target

2be0cec0a6009ae7e2e1c2d83ec9db04_JaffaCakes118.dll
Size

300KB
MD5

2be0cec0a6009ae7e2e1c2d83ec9db04
SHA1

cee436c7cf35c4e1f136d8e4421ff16e08154247
SHA256

b08d9ea7448561e8a9ae66b789b1a8fcca7adc26e9fa3d33359ff57727bbde5e
SHA512

0f8dcd5ff964d1c6f8051c05bd4093b6059edb4654b15b8d67f0ae86daf634c86d3561b0553b7ee0f14896e7777cc3929bb64678d351f7b9cfe4ab86663d1bfc
SSDEEP

6144:ZkF4Q0aQ7Bgk36c7qXJIGkyOxJW3r01h3xRIjNY0QcKU1Wgem7yOc:SmQ0aQtr6c7mjOxJBfxRCdQcveJ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 1712	1596	rundll32.exe	29
PID 1596 wrote to memory of 1712	1596	rundll32.exe	29
PID 1596 wrote to memory of 1712	1596	rundll32.exe	29
PID 1596 wrote to memory of 1712	1596	rundll32.exe	29
PID 1596 wrote to memory of 1712	1596	rundll32.exe	29
PID 1596 wrote to memory of 1712	1596	rundll32.exe	29
PID 1596 wrote to memory of 1712	1596	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2be0cec0a6009ae7e2e1c2d83ec9db04_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2be0cec0a6009ae7e2e1c2d83ec9db04_JaffaCakes118.dll,#1
  2⤵
  PID:1712