5f959db43830f1a7eeeb705767d7d5e088c57713decd167b4f3692a1475f0248

Analysis

max time kernel
15s
max time network
16s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
12-07-2024 00:35

Target

3b55afa538c826b45ce973fa1dc1e00e_JaffaCakes118.dll
Size

184KB
MD5

3b55afa538c826b45ce973fa1dc1e00e
SHA1

7bed6ef5d8455211b4a7c6fab2fd83530858a229
SHA256

5f959db43830f1a7eeeb705767d7d5e088c57713decd167b4f3692a1475f0248
SHA512

5e7c9d0a64cc74f3377947281ba59607eaeef02bdd37df06c9b51aff6c8ef2aa30d5b77d49c0243f219471bceb5eb382d7de310dc29327bd0e1cea0a5cd4e405
SSDEEP

3072:QqVqbjefAnS4z4JENucY24cLgBvoPnkcCZTaDTrUh/rrQBHX9AdwqvqyGoT:DVqfbz5NRDCBgPkcCZTaXrUtoBHtklv+

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 2272	2260	rundll32.exe	29
PID 2260 wrote to memory of 2272	2260	rundll32.exe	29
PID 2260 wrote to memory of 2272	2260	rundll32.exe	29
PID 2260 wrote to memory of 2272	2260	rundll32.exe	29
PID 2260 wrote to memory of 2272	2260	rundll32.exe	29
PID 2260 wrote to memory of 2272	2260	rundll32.exe	29
PID 2260 wrote to memory of 2272	2260	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b55afa538c826b45ce973fa1dc1e00e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b55afa538c826b45ce973fa1dc1e00e_JaffaCakes118.dll,#1
  2⤵
  PID:2272