bb2ee9a061132cb5967864053691f73394d776b8359241540ac37774c6f9ac4e

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
10-07-2024 01:46

Target

32d697f099fecabbc3400257c188488f_JaffaCakes118.dll
Size

33KB
MD5

32d697f099fecabbc3400257c188488f
SHA1

9cbdbb87dc8a3df0dde16b3ea3afebc1afb2079d
SHA256

bb2ee9a061132cb5967864053691f73394d776b8359241540ac37774c6f9ac4e
SHA512

8a18bb38954b80a86b2e90c4c26fdd69747930ebb5bb8ea8defeee25b290b59470002af5d4c62e93bb8134b2e49ede705ab350cc9a3969880d2e8ce2d1f772c6
SSDEEP

768:GPC39bq5oxE2AdR40kYO2lg7EW1DdgI5hqDMTR5b+X:GPwgAEw0kY87EWddgWk+Rd+X

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2264	3032	rundll32.exe	30
PID 3032 wrote to memory of 2264	3032	rundll32.exe	30
PID 3032 wrote to memory of 2264	3032	rundll32.exe	30
PID 3032 wrote to memory of 2264	3032	rundll32.exe	30
PID 3032 wrote to memory of 2264	3032	rundll32.exe	30
PID 3032 wrote to memory of 2264	3032	rundll32.exe	30
PID 3032 wrote to memory of 2264	3032	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\32d697f099fecabbc3400257c188488f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\32d697f099fecabbc3400257c188488f_JaffaCakes118.dll,#1
  2⤵
  PID:2264