fdae2e8dfe2ab81ffe1a7f3ab54113870c0f8ee3c41ea1fed67652139b3d8170

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 06:21

Target

2f48ab393266748ce319dd69642b0227_JaffaCakes118.dll
Size

43KB
MD5

2f48ab393266748ce319dd69642b0227
SHA1

40363e87db2ef009490d91e9bc91c1e75507dbb3
SHA256

fdae2e8dfe2ab81ffe1a7f3ab54113870c0f8ee3c41ea1fed67652139b3d8170
SHA512

542585ac66b817b5e5f0c08d0b969c8bcce2e4d7f3c2edd7b6a52a6cd5358f4e9c61effeec6d69917eaabcb343340efea20020f86451015b6a8aba78d153193f
SSDEEP

768:T2y0fCHR2MvsOcE+fIsjnhrG41IILhkuLMf6r2iW1acX64:b0fyLjfVsDhrDmuLMirc

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 2068	2064	rundll32.exe	31
PID 2064 wrote to memory of 2068	2064	rundll32.exe	31
PID 2064 wrote to memory of 2068	2064	rundll32.exe	31
PID 2064 wrote to memory of 2068	2064	rundll32.exe	31
PID 2064 wrote to memory of 2068	2064	rundll32.exe	31
PID 2064 wrote to memory of 2068	2064	rundll32.exe	31
PID 2064 wrote to memory of 2068	2064	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f48ab393266748ce319dd69642b0227_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f48ab393266748ce319dd69642b0227_JaffaCakes118.dll,#1
  2⤵
  PID:2068