057ddb7095c9823651802790fcaceff64c48d3556c170e689f72a02f03d66601

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 08:48

Target

2553cffdcfd2a8a8ae306048af361f43_JaffaCakes118.dll
Size

103KB
MD5

2553cffdcfd2a8a8ae306048af361f43
SHA1

6da2fd3433b2cb6ee039ae2bb22a9a4699d458ed
SHA256

057ddb7095c9823651802790fcaceff64c48d3556c170e689f72a02f03d66601
SHA512

e08fe0192c9e0a7a5883411abc312ff774931a37599e18f320c16c3aa4a45e7f3ea256ca377aa87f33442cfda3927e3d0fa9e27acaaa369c5bbd80dab6be04ab
SSDEEP

1536:IPmWNxhM46jqWiLhPDXuWeSBalEIobbn91VL3B/VOY9m85PafeIy:Ie4YdjL6bfR539f/s85Pafe1

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 2908	1744	rundll32.exe	28
PID 1744 wrote to memory of 2908	1744	rundll32.exe	28
PID 1744 wrote to memory of 2908	1744	rundll32.exe	28
PID 1744 wrote to memory of 2908	1744	rundll32.exe	28
PID 1744 wrote to memory of 2908	1744	rundll32.exe	28
PID 1744 wrote to memory of 2908	1744	rundll32.exe	28
PID 1744 wrote to memory of 2908	1744	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2553cffdcfd2a8a8ae306048af361f43_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2553cffdcfd2a8a8ae306048af361f43_JaffaCakes118.dll,#1
  2⤵
  PID:2908