54f5f8571d42ed793b0b18ed12482c28e2e42dcf174f3b4f210a912e6865198d

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13-07-2024 01:23

Target

3fa4e2f8ca6749d7a29cf1438c434af2_JaffaCakes118.dll
Size

91KB
MD5

3fa4e2f8ca6749d7a29cf1438c434af2
SHA1

50e0b4a897322f1be1e2430e166b12673062f23b
SHA256

54f5f8571d42ed793b0b18ed12482c28e2e42dcf174f3b4f210a912e6865198d
SHA512

945f36e18a991cdceee58c7469c9227d1d94f7b0f5370f99791b20c4fedf0c4721525a301d33006eac6d31fd89031cc1827064da4b9b2f62a4fa1f16d1abce4d
SSDEEP

1536:IT+BBKiZltebqBScHHQRZbXOQ2k1osC8lizVYYR4Nb:IT+BBhMbqB5HcZzOrSGCiZYYGt

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2352	2444	rundll32.exe	30
PID 2444 wrote to memory of 2352	2444	rundll32.exe	30
PID 2444 wrote to memory of 2352	2444	rundll32.exe	30
PID 2444 wrote to memory of 2352	2444	rundll32.exe	30
PID 2444 wrote to memory of 2352	2444	rundll32.exe	30
PID 2444 wrote to memory of 2352	2444	rundll32.exe	30
PID 2444 wrote to memory of 2352	2444	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3fa4e2f8ca6749d7a29cf1438c434af2_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3fa4e2f8ca6749d7a29cf1438c434af2_JaffaCakes118.dll,#1
  2⤵
  PID:2352