ae6795e9b30d637284d81f45b50584c790a05750cef0c56c97eb8a4449dc3a19

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 17:43

Target

2d3fb45bb4e630f5e7f87606c98f5402_JaffaCakes118.dll
Size

32KB
MD5

2d3fb45bb4e630f5e7f87606c98f5402
SHA1

9627a34294b75bf1eda1163ec7ecc5900976228a
SHA256

ae6795e9b30d637284d81f45b50584c790a05750cef0c56c97eb8a4449dc3a19
SHA512

e27988ad8c0b807dc6534ab807b7f256a300bfb0a91f2fed6fa61bd74f57d5fdf4faa2859e25181760555f297d6f3fa83977e6b4829b4c54e7f0cb773680f748
SSDEEP

768:FdZfKcCBEerp5OFlm7A4oknszhqDINR9mQChw:FdZlCRrKa7AHFkUNRZCG

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 1888	2280	rundll32.exe	31
PID 2280 wrote to memory of 1888	2280	rundll32.exe	31
PID 2280 wrote to memory of 1888	2280	rundll32.exe	31
PID 2280 wrote to memory of 1888	2280	rundll32.exe	31
PID 2280 wrote to memory of 1888	2280	rundll32.exe	31
PID 2280 wrote to memory of 1888	2280	rundll32.exe	31
PID 2280 wrote to memory of 1888	2280	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d3fb45bb4e630f5e7f87606c98f5402_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d3fb45bb4e630f5e7f87606c98f5402_JaffaCakes118.dll,#1
  2⤵
  PID:1888