bdad82fa2f0af101fb8b881446b9a9e3c416dd0235e1e68c23b5ba0ac592d537

Analysis

max time kernel
14s
max time network
21s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23-07-2024 00:57

Target

65835b494d91a2fd04eb0ffd9d0d6e63_JaffaCakes118.dll
Size

21KB
MD5

65835b494d91a2fd04eb0ffd9d0d6e63
SHA1

32ab786f99f4572e8b5102f89b8adaf9029d2422
SHA256

bdad82fa2f0af101fb8b881446b9a9e3c416dd0235e1e68c23b5ba0ac592d537
SHA512

bdaee1687d98f2578ce15ae52f0bea749507111e20c863567211121a662099eadce8e3fb65f2dfe7e6842e21e23aa35b3080a9ec2847d7891a3d5706aad742de
SSDEEP

384:AWtS67EEL9BauVzFvt+YvzMYj2+o9oV8zi9sIIT/eHLkqwv/H8WDVwvU0lF2:jaa9kuVpvt+YbMYy+oUGbeHwrXVwvU0G

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2408	1732	rundll32.exe	29
PID 1732 wrote to memory of 2408	1732	rundll32.exe	29
PID 1732 wrote to memory of 2408	1732	rundll32.exe	29
PID 1732 wrote to memory of 2408	1732	rundll32.exe	29
PID 1732 wrote to memory of 2408	1732	rundll32.exe	29
PID 1732 wrote to memory of 2408	1732	rundll32.exe	29
PID 1732 wrote to memory of 2408	1732	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\65835b494d91a2fd04eb0ffd9d0d6e63_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\65835b494d91a2fd04eb0ffd9d0d6e63_JaffaCakes118.dll,#1
  2⤵
  PID:2408