52b4fecf59020f013e01c6463c2c4510b1b9c9393233e64368f2c7737549a727

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08-07-2024 06:33

Target

2b52f952f9796cc7426b487d52f8da9b_JaffaCakes118.dll
Size

28KB
MD5

2b52f952f9796cc7426b487d52f8da9b
SHA1

2d2f871152cead3dabcc75429f7debfa35e853bc
SHA256

52b4fecf59020f013e01c6463c2c4510b1b9c9393233e64368f2c7737549a727
SHA512

1191a597b2aa87ce62e6bb74f1bbf17fd4f1e4cb689401a76ef23a01ed1545d42de4908ed9f12db9d71e119c1b5eca204386592851db5ff238c177f19f562c3e
SSDEEP

384:EciGuqgBsKsOx2dvQdJP6w4EMMJVl+OhNx1qbwm:QG6fxSfwdll+6Nfqj

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 2116	1820	rundll32.exe	30
PID 1820 wrote to memory of 2116	1820	rundll32.exe	30
PID 1820 wrote to memory of 2116	1820	rundll32.exe	30
PID 1820 wrote to memory of 2116	1820	rundll32.exe	30
PID 1820 wrote to memory of 2116	1820	rundll32.exe	30
PID 1820 wrote to memory of 2116	1820	rundll32.exe	30
PID 1820 wrote to memory of 2116	1820	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b52f952f9796cc7426b487d52f8da9b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b52f952f9796cc7426b487d52f8da9b_JaffaCakes118.dll,#1
  2⤵
  PID:2116