5316af1387ad8eba098d8133e5853c7f0ba7ad5eba2dfc629bfb3017799cc26c

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19-07-2024 03:23

Target

5a45f35052bee7720211019b1bd6f9d6_JaffaCakes118.dll
Size

110KB
MD5

5a45f35052bee7720211019b1bd6f9d6
SHA1

8cc2548648cec5ed3fe187a60321306edebe8001
SHA256

5316af1387ad8eba098d8133e5853c7f0ba7ad5eba2dfc629bfb3017799cc26c
SHA512

9d0d0d093ade5f05554c65fdeb556744300be8a30460496c39441cd5ae77c31c0bdbc144cd34f41f79a4389c5dd8a650d38df1f511f8c15826621ea50e92542d
SSDEEP

3072:02RWdNEp4LsidqhaN5tTTKtN2kZ2dVkYccwl8cgLDRA:02RWdNEqgARrtTTKv262d6Ycci8cgLlA

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2152	2672	rundll32.exe	31
PID 2672 wrote to memory of 2152	2672	rundll32.exe	31
PID 2672 wrote to memory of 2152	2672	rundll32.exe	31
PID 2672 wrote to memory of 2152	2672	rundll32.exe	31
PID 2672 wrote to memory of 2152	2672	rundll32.exe	31
PID 2672 wrote to memory of 2152	2672	rundll32.exe	31
PID 2672 wrote to memory of 2152	2672	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a45f35052bee7720211019b1bd6f9d6_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a45f35052bee7720211019b1bd6f9d6_JaffaCakes118.dll,#1
  2⤵
  PID:2152

memory/2152-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/2152-1-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download