5bbadef715235df3a03815edb7c4e5988c6f24e8dc76010a472ee890edcc83a8

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09-07-2024 21:39

Target

321344dd5319d5bfd9b6c1ddc372f22c_JaffaCakes118.dll
Size

61KB
MD5

321344dd5319d5bfd9b6c1ddc372f22c
SHA1

cfa03fc0aa5f463a22896e54f7dde1ae48cc91cb
SHA256

5bbadef715235df3a03815edb7c4e5988c6f24e8dc76010a472ee890edcc83a8
SHA512

955e89fa61a8bef420a8736bfb6da455900aab30686f9b0d9b531cdae1a479600a5997cf49d44160e665492a44c9ca361f0566f20e06c06225336fb5b5e78b42
SSDEEP

1536:0+4hdsDYTVD3W4mBZABOEj74HSv9T21obmoy:0+IsDYhqDzDvHy9T21obe

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2528	2204	rundll32.exe	30
PID 2204 wrote to memory of 2528	2204	rundll32.exe	30
PID 2204 wrote to memory of 2528	2204	rundll32.exe	30
PID 2204 wrote to memory of 2528	2204	rundll32.exe	30
PID 2204 wrote to memory of 2528	2204	rundll32.exe	30
PID 2204 wrote to memory of 2528	2204	rundll32.exe	30
PID 2204 wrote to memory of 2528	2204	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\321344dd5319d5bfd9b6c1ddc372f22c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\321344dd5319d5bfd9b6c1ddc372f22c_JaffaCakes118.dll,#1
  2⤵
  PID:2528