0104f20ff030c06bafb2f132d8180dd5930452f999b60c9a7a4f83bccb06f016

Analysis

max time kernel
93s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15-04-2024 06:53

Target

f0859dfcc2fb9611c1811ffb9c1b1498_JaffaCakes118.dll
Size

15KB
MD5

f0859dfcc2fb9611c1811ffb9c1b1498
SHA1

7607fc0d09443b177521aac784274fd9fee1d2c4
SHA256

0104f20ff030c06bafb2f132d8180dd5930452f999b60c9a7a4f83bccb06f016
SHA512

f1a21279440a1cf0e35465b46c2cf9df45e669e6d69a19d596c0e38a9a01054b3d3140aabedb85eade3a9bc6f79d71cbba999b629e7a8998b32680c843c63c22
SSDEEP

192:UnITMl2Zjs0/uA/OHoxgbTN+waBeHW5l7/vkQvvnyuh5E3pHAMy9UgvhB:UnIHZjs049TN6N7nlh5E1AMvgpB

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4272 wrote to memory of 1748	4272	rundll32.exe	86
PID 4272 wrote to memory of 1748	4272	rundll32.exe	86
PID 4272 wrote to memory of 1748	4272	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f0859dfcc2fb9611c1811ffb9c1b1498_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f0859dfcc2fb9611c1811ffb9c1b1498_JaffaCakes118.dll,#1
  2⤵
  PID:1748

memory/1748-0-0x0000000010000000-0x000000001006C000-memory.dmp

Filesize
432KB

Download