9e936c2223df030f691593b69f893a0e75f7b4c509d729faed312d1ab854f329

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08-07-2024 21:24

Target

2dd99940fd41d3976e6348c78893a430_JaffaCakes118.dll
Size

33KB
MD5

2dd99940fd41d3976e6348c78893a430
SHA1

4499dbcdd08fc1f99e4c8c9b90c19581a9429cf1
SHA256

9e936c2223df030f691593b69f893a0e75f7b4c509d729faed312d1ab854f329
SHA512

f9e027592de846a5577543e4922b84124c06bf905fb703fba35e2b7096457c47b59e593dee783f0051f0a2eae32e9e9368c954b657435f2d570d677e1f2b792b
SSDEEP

768:oMfGZwZRWH0f6uv+R74BufMSVOk8GRhPoi:oAGZkm0n274BufVhRNB

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 1952	2080	rundll32.exe	30
PID 2080 wrote to memory of 1952	2080	rundll32.exe	30
PID 2080 wrote to memory of 1952	2080	rundll32.exe	30
PID 2080 wrote to memory of 1952	2080	rundll32.exe	30
PID 2080 wrote to memory of 1952	2080	rundll32.exe	30
PID 2080 wrote to memory of 1952	2080	rundll32.exe	30
PID 2080 wrote to memory of 1952	2080	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2dd99940fd41d3976e6348c78893a430_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2dd99940fd41d3976e6348c78893a430_JaffaCakes118.dll,#1
  2⤵
  PID:1952