2b0df65911f08a5214bff88d0f4058c5d1463d4d5e1a159d9c490c0c70b71d8c

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
20-07-2024 03:18

Target

5ed4c8e9acefe696b703ed6fc47997db_JaffaCakes118.dll
Size

57KB
MD5

5ed4c8e9acefe696b703ed6fc47997db
SHA1

9a929c87c1e84844d09ab1c92dc0b0d966167f73
SHA256

2b0df65911f08a5214bff88d0f4058c5d1463d4d5e1a159d9c490c0c70b71d8c
SHA512

0c2ba55fcf20d62a554ef9b900c73526a2d45dca665c299364fd21b76d83aed4ceba0153e662a6f5fb297c3a4cecae071b280bb21d2e8cace74ae7e9c8d40f46
SSDEEP

1536:V2bm2IFRTaSG3vOxaIh4ShZmRqoiDs07Rf/7E5Zg:WsvlEGxDPhWqRX7E/g

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 1708	2548	rundll32.exe	30
PID 2548 wrote to memory of 1708	2548	rundll32.exe	30
PID 2548 wrote to memory of 1708	2548	rundll32.exe	30
PID 2548 wrote to memory of 1708	2548	rundll32.exe	30
PID 2548 wrote to memory of 1708	2548	rundll32.exe	30
PID 2548 wrote to memory of 1708	2548	rundll32.exe	30
PID 2548 wrote to memory of 1708	2548	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ed4c8e9acefe696b703ed6fc47997db_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ed4c8e9acefe696b703ed6fc47997db_JaffaCakes118.dll,#1
  2⤵
  PID:1708