0e2d1bb0307b14a5ff080b1571ef96445c56f50c7f87c218244cdc5469be3fee

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 15:11

Target

2cce79f55d9ef46d98fb7ad2a7acc0da_JaffaCakes118.dll
Size

13KB
MD5

2cce79f55d9ef46d98fb7ad2a7acc0da
SHA1

658d45fe3bdc93ab7e44c031c9de63571998a1ca
SHA256

0e2d1bb0307b14a5ff080b1571ef96445c56f50c7f87c218244cdc5469be3fee
SHA512

f8011a9d2ace2f14654de3d6cf05893c54f9bde75f911114725438e4ae3403e3d4be03534fe9bbae07d8eaf7d6bfbaea2f63143164cff0921c547aace7ae7a31
SSDEEP

384:cDGaLDNc4q4yLYfuSfvX8WfhGs5VYpAmmtGxYcfFY:cCWZc4B4aP7cvpA8ecG

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2216	2208	rundll32.exe	31
PID 2208 wrote to memory of 2216	2208	rundll32.exe	31
PID 2208 wrote to memory of 2216	2208	rundll32.exe	31
PID 2208 wrote to memory of 2216	2208	rundll32.exe	31
PID 2208 wrote to memory of 2216	2208	rundll32.exe	31
PID 2208 wrote to memory of 2216	2208	rundll32.exe	31
PID 2208 wrote to memory of 2216	2208	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2cce79f55d9ef46d98fb7ad2a7acc0da_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2cce79f55d9ef46d98fb7ad2a7acc0da_JaffaCakes118.dll,#1
  2⤵
  PID:2216