d47cd5d10d5fb702cf7e6520d275d77dd1aaa5d1e5a9938683040cfcff4a8c53

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
17-04-2024 14:34

Target

f5fde82db217ee2a189a317f0aac5755_JaffaCakes118.dll
Size

84KB
MD5

f5fde82db217ee2a189a317f0aac5755
SHA1

65ed73a9c2c740afa5c901f0384b799ccffd413e
SHA256

d47cd5d10d5fb702cf7e6520d275d77dd1aaa5d1e5a9938683040cfcff4a8c53
SHA512

8856f0f2e91458cedb602d42cc0586427024c5551578cdec40c7c73456df7b5f945c0a6190cd737394d25753e8bee614bb698c1405b242d3084453aaaf751482
SSDEEP

1536:3kuZcOnTIQXiOobuM03cx9jFb4goNFKrGK9+8XVHYVHWUAS:tZcH0fTd3cxX8g3BS

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2304	2292	rundll32.exe	28
PID 2292 wrote to memory of 2304	2292	rundll32.exe	28
PID 2292 wrote to memory of 2304	2292	rundll32.exe	28
PID 2292 wrote to memory of 2304	2292	rundll32.exe	28
PID 2292 wrote to memory of 2304	2292	rundll32.exe	28
PID 2292 wrote to memory of 2304	2292	rundll32.exe	28
PID 2292 wrote to memory of 2304	2292	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f5fde82db217ee2a189a317f0aac5755_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f5fde82db217ee2a189a317f0aac5755_JaffaCakes118.dll,#1
  2⤵
  PID:2304