bdf33afd87fdb4dbd284421917f0946b70cd526933b091663d5d50da34dfe2a5

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 08:03

Target

33e6b19c89f80d3c8573ef9618a9c275_JaffaCakes118.dll
Size

14KB
MD5

33e6b19c89f80d3c8573ef9618a9c275
SHA1

2cbac8fda118aad0004e784641b89fca59e1bcd4
SHA256

bdf33afd87fdb4dbd284421917f0946b70cd526933b091663d5d50da34dfe2a5
SHA512

2de482b2fefb554a9b0d1da9bbc914347d15a2dd97f5ebc3c363640aabe997cbab3e4a2218c52b368808a32ef211655726d6458b9301d2cb7d58493497383055
SSDEEP

96:JyJ3b26auUqPTgfWOQD7Xkr04ZsfLTY3WiB9nC2mhda:JyJr3aulTgeOQD/4wKJmhda

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 2536	2412	rundll32.exe	30
PID 2412 wrote to memory of 2536	2412	rundll32.exe	30
PID 2412 wrote to memory of 2536	2412	rundll32.exe	30
PID 2412 wrote to memory of 2536	2412	rundll32.exe	30
PID 2412 wrote to memory of 2536	2412	rundll32.exe	30
PID 2412 wrote to memory of 2536	2412	rundll32.exe	30
PID 2412 wrote to memory of 2536	2412	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\33e6b19c89f80d3c8573ef9618a9c275_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\33e6b19c89f80d3c8573ef9618a9c275_JaffaCakes118.dll,#1
  2⤵
  PID:2536