50c0311db5e4f587cb5b5a041ee44b93f30cec6c836cd7cf0a5efe066e6181d8

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 17:01

Target

2d2001f21ee3d42bf093bc9ac0195e22_JaffaCakes118.dll
Size

318KB
MD5

2d2001f21ee3d42bf093bc9ac0195e22
SHA1

8d9f3b1d92afd5b09d6ebbe20680adbbebd3daf4
SHA256

50c0311db5e4f587cb5b5a041ee44b93f30cec6c836cd7cf0a5efe066e6181d8
SHA512

bfdba70b1c57cc6068010037145fd756d15d0e4eaeccaf7bf1f066c00642658b8b7363fc1c4a4149f04e292a59cf9e55fe8206e0c8367fdc5cad4eb13f2d636e
SSDEEP

6144:mvDDHy5z2wg9btsWXxntETMF4efN3VnlfxG4x+7UX9lwdpPbkg8TF+8g:GDS5zng5+8n8vMVlZF+7UTUTkg8R+8g

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 384 wrote to memory of 2404	384	rundll32.exe	30
PID 384 wrote to memory of 2404	384	rundll32.exe	30
PID 384 wrote to memory of 2404	384	rundll32.exe	30
PID 384 wrote to memory of 2404	384	rundll32.exe	30
PID 384 wrote to memory of 2404	384	rundll32.exe	30
PID 384 wrote to memory of 2404	384	rundll32.exe	30
PID 384 wrote to memory of 2404	384	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d2001f21ee3d42bf093bc9ac0195e22_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:384
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d2001f21ee3d42bf093bc9ac0195e22_JaffaCakes118.dll,#1
  2⤵
  PID:2404