ab0733d6846ade7e002c32875f143dd08af00d6d76d20579b2f51c9d15bc5dc4

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/04/2024, 12:10

Target

e2835919394afdcf927f28acf04d3291_JaffaCakes118.dll
Size

601KB
MD5

e2835919394afdcf927f28acf04d3291
SHA1

5ddca71fa418dbd13fb16494a4236cf2adddfa25
SHA256

ab0733d6846ade7e002c32875f143dd08af00d6d76d20579b2f51c9d15bc5dc4
SHA512

5a527cf8b9ac664a7dc9e89c694d499fc9376cdf51c562190c5b3ccbeaffa06a10ea1b063b30acf7f4ce54be41739e07578cc1399a1ccf60e4f253f7b1c594d2
SSDEEP

12288:qyTM4ZB4Sb3jBf9Z4voacqVTfsh9hVYOaEAItL0q:Y4ZBjbTBlZLapZsh9hvaUtYq

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 2068	2124	rundll32.exe	85
PID 2124 wrote to memory of 2068	2124	rundll32.exe	85
PID 2124 wrote to memory of 2068	2124	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e2835919394afdcf927f28acf04d3291_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e2835919394afdcf927f28acf04d3291_JaffaCakes118.dll,#1
  2⤵
  PID:2068

memory/2068-0-0x0000000020000000-0x000000002000C000-memory.dmp

Filesize
48KB

Download