9970b2120687b75cd59b0b0ef2a94d0443c3521113504e6e4d7b588f1a5d206e

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 06:29

Target

2f4e6e49ab2cce08f795e6099e23734f_JaffaCakes118.dll
Size

72KB
MD5

2f4e6e49ab2cce08f795e6099e23734f
SHA1

71f85fefce874d941afdf6861b931d27cafa7aa0
SHA256

9970b2120687b75cd59b0b0ef2a94d0443c3521113504e6e4d7b588f1a5d206e
SHA512

bcc47583357b2b4d9cace7f9518ddd5a0e8bfef8a185dd62050ff40fc3c4e360951d464cb750ba89ff5cc8416e2196dfe984f697a7978232a22f01fe2c5b64b8
SSDEEP

1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuv:C5UOq0ukgOK2l7aFQv

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 1412	2476	rundll32.exe	31
PID 2476 wrote to memory of 1412	2476	rundll32.exe	31
PID 2476 wrote to memory of 1412	2476	rundll32.exe	31
PID 2476 wrote to memory of 1412	2476	rundll32.exe	31
PID 2476 wrote to memory of 1412	2476	rundll32.exe	31
PID 2476 wrote to memory of 1412	2476	rundll32.exe	31
PID 2476 wrote to memory of 1412	2476	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f4e6e49ab2cce08f795e6099e23734f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f4e6e49ab2cce08f795e6099e23734f_JaffaCakes118.dll,#1
  2⤵
  PID:1412