5ae2d7585e19d102a56237af42e0925fde0d9865f943551a6692c7e4b527eb6d

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
20-05-2024 01:12

Target

5c6c61991c5f6c5cd8ad196605ad4c57_JaffaCakes118.dll
Size

178KB
MD5

5c6c61991c5f6c5cd8ad196605ad4c57
SHA1

cdb42d25443dbc85a0a5153671cd316e1e360f88
SHA256

5ae2d7585e19d102a56237af42e0925fde0d9865f943551a6692c7e4b527eb6d
SHA512

97af74b1ecc1fb3aabfa6adfdf99b5794de5d2de74672bd3a61215c778bbe34aebc66430f000a416b24913d901484a8ffa23af47c2f263518bb0af6ac88a9c21
SSDEEP

1536:NFlzVeVCmEhgsWdQydt2vmbjSWe72CvW5ZPGyzyYAuPDYZIMVg50FeHg:NF3eqhQd1c2CARG1uPaIWg50qg

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2852	2548	rundll32.exe	28
PID 2548 wrote to memory of 2852	2548	rundll32.exe	28
PID 2548 wrote to memory of 2852	2548	rundll32.exe	28
PID 2548 wrote to memory of 2852	2548	rundll32.exe	28
PID 2548 wrote to memory of 2852	2548	rundll32.exe	28
PID 2548 wrote to memory of 2852	2548	rundll32.exe	28
PID 2548 wrote to memory of 2852	2548	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c6c61991c5f6c5cd8ad196605ad4c57_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c6c61991c5f6c5cd8ad196605ad4c57_JaffaCakes118.dll,#1
  2⤵
  PID:2852