5dcda73f00a6b5aaadc50f3a2d8d536ef7ce123577d98b686b371d6c7aea9093

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 12:24

Target

71f0bd5119e5696538e838ad01842cbf_JaffaCakes118.dll
Size

8KB
MD5

71f0bd5119e5696538e838ad01842cbf
SHA1

082275560defdda9d439aabc1ce201e90702ce11
SHA256

5dcda73f00a6b5aaadc50f3a2d8d536ef7ce123577d98b686b371d6c7aea9093
SHA512

b73622520a3f724844ee9d2d0a72340b8dbb4720b23fe2bf99c14c6bed980ce5a6b2eb7654f45f2c1a02ce307c97546da13a306cfae7ffc4235ec2c7e7b712e3
SSDEEP

192:qqPX8E5ysHkEkJvJZpKuvriHPTGjPfu89QjVwbXIBP6WYp:fPsEMsgXrKuvrivij289QjVM4Yp

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 2960	2952	rundll32.exe	28
PID 2952 wrote to memory of 2960	2952	rundll32.exe	28
PID 2952 wrote to memory of 2960	2952	rundll32.exe	28
PID 2952 wrote to memory of 2960	2952	rundll32.exe	28
PID 2952 wrote to memory of 2960	2952	rundll32.exe	28
PID 2952 wrote to memory of 2960	2952	rundll32.exe	28
PID 2952 wrote to memory of 2960	2952	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\71f0bd5119e5696538e838ad01842cbf_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\71f0bd5119e5696538e838ad01842cbf_JaffaCakes118.dll,#1
  2⤵
  PID:2960

memory/2960-2-0x000000006DB00000-0x000000006DB0D000-memory.dmp

Filesize
52KB

Download
memory/2960-1-0x000000006DB00000-0x000000006DB0D000-memory.dmp

Filesize
52KB

Download
memory/2960-0-0x000000006DB00000-0x000000006DB0D000-memory.dmp

Filesize
52KB

Download
memory/2960-3-0x000000006DB00000-0x000000006DB0D000-memory.dmp

Filesize
52KB

Download