8ce2bfabd4d2485ed3c04733bdd15dc1aeae7e55737017044fb99053ecd2c08f

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 16:58

Target

2d1ce6de743384b61d9a8dd8c61d82db_JaffaCakes118.dll
Size

32KB
MD5

2d1ce6de743384b61d9a8dd8c61d82db
SHA1

5d2c006413c1c6622f0d35838b6cbfd993abd68b
SHA256

8ce2bfabd4d2485ed3c04733bdd15dc1aeae7e55737017044fb99053ecd2c08f
SHA512

ce1e0a1a53467bcdbd288b968f0daf337912e6c0c4e4e1ffa37568e6a137d7b9d6620c006ae90eb80f63e57d2848ff3ed3245e564e060707dc9f7508bfa87122
SSDEEP

768:Jeldeu9AQjOMas7F5ibr7IYQmN8S56cJbMBBQARQkvVv:J8IggAs6cJbMBBQAR

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 2412	1752	rundll32.exe	29
PID 1752 wrote to memory of 2412	1752	rundll32.exe	29
PID 1752 wrote to memory of 2412	1752	rundll32.exe	29
PID 1752 wrote to memory of 2412	1752	rundll32.exe	29
PID 1752 wrote to memory of 2412	1752	rundll32.exe	29
PID 1752 wrote to memory of 2412	1752	rundll32.exe	29
PID 1752 wrote to memory of 2412	1752	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d1ce6de743384b61d9a8dd8c61d82db_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d1ce6de743384b61d9a8dd8c61d82db_JaffaCakes118.dll,#1
  2⤵
  PID:2412