92884be6e1b6fc6c1b43911fc598f8aad2e48751dfa0c399b90720c101dae1c6

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 15:29

Target

2cda6d0d360886c46be1665e03f32709_JaffaCakes118.dll
Size

5KB
MD5

2cda6d0d360886c46be1665e03f32709
SHA1

e58458e1414ef69c987c15ab0a18153c4134d792
SHA256

92884be6e1b6fc6c1b43911fc598f8aad2e48751dfa0c399b90720c101dae1c6
SHA512

0e2d91aa0f46a3f2edf430295b2a172e6220b68402170edb36a008a8b9d94ebc2c09acf7ab54fd16ca705c02096aa68454449aaf3432e1182fb9feb8460d22df
SSDEEP

96:RxDi6iiGIaXowjJj8KE7milmQ1k6GsvvV0DB5UVMecB7nt8BH:Rx+a1eSK+VSDcmF5G

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 2632	2780	rundll32.exe	30
PID 2780 wrote to memory of 2632	2780	rundll32.exe	30
PID 2780 wrote to memory of 2632	2780	rundll32.exe	30
PID 2780 wrote to memory of 2632	2780	rundll32.exe	30
PID 2780 wrote to memory of 2632	2780	rundll32.exe	30
PID 2780 wrote to memory of 2632	2780	rundll32.exe	30
PID 2780 wrote to memory of 2632	2780	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2cda6d0d360886c46be1665e03f32709_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2cda6d0d360886c46be1665e03f32709_JaffaCakes118.dll,#1
  2⤵
  PID:2632