d54fd5efa649e48e647de08f4589cfcdf36ff352d55ff1f61bbedb169e4ee540

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 21:37

Target

5dc3d2832b9255e3d58f7cf239923a75_JaffaCakes118.dll
Size

237KB
MD5

5dc3d2832b9255e3d58f7cf239923a75
SHA1

0086989be974916e429e34945361b38b1dcfa738
SHA256

d54fd5efa649e48e647de08f4589cfcdf36ff352d55ff1f61bbedb169e4ee540
SHA512

5b74658d674baa1a6d1834d38de10b6ab597246550264e3e0b69329607afd2d0be3f7b5ff96370abaa200eced1bfee939ff1fe289e1824e952b82a2b8fd12940
SSDEEP

6144:K5SNpXmEgn32vYWc4TZX20+Wf+xpPRo9SZR:KE7mEgnGIuFNHf+xp2E3

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2964	2256	rundll32.exe	30
PID 2256 wrote to memory of 2964	2256	rundll32.exe	30
PID 2256 wrote to memory of 2964	2256	rundll32.exe	30
PID 2256 wrote to memory of 2964	2256	rundll32.exe	30
PID 2256 wrote to memory of 2964	2256	rundll32.exe	30
PID 2256 wrote to memory of 2964	2256	rundll32.exe	30
PID 2256 wrote to memory of 2964	2256	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5dc3d2832b9255e3d58f7cf239923a75_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5dc3d2832b9255e3d58f7cf239923a75_JaffaCakes118.dll,#1
  2⤵
  PID:2964