1e102bdc029c12f0e597d8676b5453cd785bf389c281f777a257efd46f09c2d7

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19-07-2024 12:41

Target

5bfcd9b06d57c79a788db9bbb9ab0f1b_JaffaCakes118.dll
Size

6.6MB
MD5

5bfcd9b06d57c79a788db9bbb9ab0f1b
SHA1

14de5ec565c625622d2b039898158f8b4b9980af
SHA256

1e102bdc029c12f0e597d8676b5453cd785bf389c281f777a257efd46f09c2d7
SHA512

1ba207e3a44dceca079941dba61af1d665f81b04b2ca8a3576fe49d772ae936b95136b3fbe9065c015d35f807ec540ef9d1c6a5549964b84f1d7319d1fc22355
SSDEEP

98304:1tTOy/2z7Y9FDxz3ETXwLpju5khqtSaJ8vixbB+pQryqUd:PP9Tpu5khY8vE+yrNs

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 2584 wrote to memory of 1556	2584	rundll32.exe	30
PID 2584 wrote to memory of 1556	2584	rundll32.exe	30
PID 2584 wrote to memory of 1556	2584	rundll32.exe	30
PID 2584 wrote to memory of 1556	2584	rundll32.exe	30
PID 2584 wrote to memory of 1556	2584	rundll32.exe	30
PID 2584 wrote to memory of 1556	2584	rundll32.exe	30
PID 2584 wrote to memory of 1556	2584	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5bfcd9b06d57c79a788db9bbb9ab0f1b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5bfcd9b06d57c79a788db9bbb9ab0f1b_JaffaCakes118.dll,#1
  2⤵
  PID:1556