5ef899a2538312a1b55c8878ee4ea752d85400dfda59710d57a85d57ca567e7a

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 11:28

Target

417b55c57e05d4488895ed464b2aefa7_JaffaCakes118.dll
Size

96KB
MD5

417b55c57e05d4488895ed464b2aefa7
SHA1

292550b44f55d7e539e62b72aa4cbd2f7ef1edce
SHA256

5ef899a2538312a1b55c8878ee4ea752d85400dfda59710d57a85d57ca567e7a
SHA512

9d3bb68f3525f822f06b0d0b8314d55697884aefc68926f3241cecc5446b12aee3689a96fbf03a7e4e8c66113ca0ad2d3d22c020c98f955a897dec9aafcc482a
SSDEEP

1536:k1VkUxRpQf4VKnKeO7DZhM6Z1vS2JRC+TqsG7K:+2UxPvVKNiNz1a2JRC+Tq/K

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1644	2040	rundll32.exe	30
PID 2040 wrote to memory of 1644	2040	rundll32.exe	30
PID 2040 wrote to memory of 1644	2040	rundll32.exe	30
PID 2040 wrote to memory of 1644	2040	rundll32.exe	30
PID 2040 wrote to memory of 1644	2040	rundll32.exe	30
PID 2040 wrote to memory of 1644	2040	rundll32.exe	30
PID 2040 wrote to memory of 1644	2040	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\417b55c57e05d4488895ed464b2aefa7_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\417b55c57e05d4488895ed464b2aefa7_JaffaCakes118.dll,#1
  2⤵
  PID:1644