0701f2c32b129ee97e406f5c5cbf09be525b8e288762851aee917bb4703b4647

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 03:57

Target

33377c1ec381f356890361e08cadb188_JaffaCakes118.dll
Size

33KB
MD5

33377c1ec381f356890361e08cadb188
SHA1

df75be667d3530b8561a3e31fd98fa99b92aff2f
SHA256

0701f2c32b129ee97e406f5c5cbf09be525b8e288762851aee917bb4703b4647
SHA512

c45fb9ed54a1016471951c8679adba3db2812eb18d14d6cfb9fe9b72ef7569757a40e318ebc940cee41f15a41a1992054ad924f413253d0e12af8e938c6920ef
SSDEEP

768:PmgovWiIps/FV+TlW429WjFr3IM27/QqGZDlOiOMdCR:ugovWiIpVsWJrYf7/DGZd3CR

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 2216	2128	rundll32.exe	31
PID 2128 wrote to memory of 2216	2128	rundll32.exe	31
PID 2128 wrote to memory of 2216	2128	rundll32.exe	31
PID 2128 wrote to memory of 2216	2128	rundll32.exe	31
PID 2128 wrote to memory of 2216	2128	rundll32.exe	31
PID 2128 wrote to memory of 2216	2128	rundll32.exe	31
PID 2128 wrote to memory of 2216	2128	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\33377c1ec381f356890361e08cadb188_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\33377c1ec381f356890361e08cadb188_JaffaCakes118.dll,#1
  2⤵
  PID:2216