5ec3ae249621e50a423e933bcef756135bc1cb555679e6d3a296d216453558f1

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/04/2024, 16:37 UTC

Target

ede089f7a5ecf3709949c0295668fa37_JaffaCakes118.dll
Size

842KB
MD5

ede089f7a5ecf3709949c0295668fa37
SHA1

b8dc4e5e208958a5df1063893935848eadecd160
SHA256

5ec3ae249621e50a423e933bcef756135bc1cb555679e6d3a296d216453558f1
SHA512

d14a50607e03a5d75bf527e0e69fa8969aa4bb48fe8ffa38861115d2735958bd6e58384fef8e03f6bfaa5d3266949da3679a4896231b3ef46fd1df343d3d626c
SSDEEP

12288:68n1eFPnpNjiSgS4iM7qfIYljluMIv52YOwR4qNmgR7pnq:gImK

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 2368	1440	rundll32.exe	28
PID 1440 wrote to memory of 2368	1440	rundll32.exe	28
PID 1440 wrote to memory of 2368	1440	rundll32.exe	28
PID 1440 wrote to memory of 2368	1440	rundll32.exe	28
PID 1440 wrote to memory of 2368	1440	rundll32.exe	28
PID 1440 wrote to memory of 2368	1440	rundll32.exe	28
PID 1440 wrote to memory of 2368	1440	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ede089f7a5ecf3709949c0295668fa37_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ede089f7a5ecf3709949c0295668fa37_JaffaCakes118.dll,#1
  2⤵
  PID:2368