135df042fa2097e0a644d7872e2027837938389fe887184a480ab5b9fca6870b

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 11:48

Target

5ee8d5b1987c47207265cdbfad108b3e_JaffaCakes118.dll
Size

2.0MB
MD5

5ee8d5b1987c47207265cdbfad108b3e
SHA1

9bc3d68315b3dca5f7a8de3b8ff7de5a452292eb
SHA256

135df042fa2097e0a644d7872e2027837938389fe887184a480ab5b9fca6870b
SHA512

eb31eac2d2745d788cf42dbcc7000cd94f84578f52d03773ba26492c9a105371bc1b29154606e73414823e3410dfa0115d9ed1d3427e447e001ddc8b23433569
SSDEEP

49152:RqC84en0mxjNafvF0DrA42chMFctwtQzJCuUJ:UVVNafvFM7O

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2936	2168	rundll32.exe	28
PID 2168 wrote to memory of 2936	2168	rundll32.exe	28
PID 2168 wrote to memory of 2936	2168	rundll32.exe	28
PID 2168 wrote to memory of 2936	2168	rundll32.exe	28
PID 2168 wrote to memory of 2936	2168	rundll32.exe	28
PID 2168 wrote to memory of 2936	2168	rundll32.exe	28
PID 2168 wrote to memory of 2936	2168	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ee8d5b1987c47207265cdbfad108b3e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ee8d5b1987c47207265cdbfad108b3e_JaffaCakes118.dll,#1
  2⤵
  PID:2936