db66ffdf6feeec43f28a807c33d6c50e80a5b293ca417b9ecb6b00dd7a36768c

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11-04-2024 10:55

Target

ed41319a9a7eacf4866be0cd71a4655b_JaffaCakes118.dll
Size

95KB
MD5

ed41319a9a7eacf4866be0cd71a4655b
SHA1

709553b57735fdac7ce5cfd0d7a4235b6d6a51a7
SHA256

db66ffdf6feeec43f28a807c33d6c50e80a5b293ca417b9ecb6b00dd7a36768c
SHA512

009409dcb0a7f6ceedd855e7987856b3575eeb4eaba79d0be9fe8101ae3bf41841eae1619a5f4c29bbf781be4eb4d2a68b25001b71d2291866aa506d492b9d32
SSDEEP

1536:jxtLWJcgCmIxKOocuI/JqLM0vm2Cg4G4tHOhr/nIbpxpoYhfjwoGU/MYUP:jXLWn3oaqJqLMDRG4Rpxzt3GUEYUP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 388	2136	rundll32.exe	87
PID 2136 wrote to memory of 388	2136	rundll32.exe	87
PID 2136 wrote to memory of 388	2136	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ed41319a9a7eacf4866be0cd71a4655b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ed41319a9a7eacf4866be0cd71a4655b_JaffaCakes118.dll,#1
  2⤵
  PID:388

memory/388-0-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download