da723591653eed629452ec3ee217a897296ccaca1bb5fae8dceb8ae3a855c352

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15/04/2024, 17:47

Target

f1a1c11ab4cc45bac3e1e92e2875aad0_JaffaCakes118.dll
Size

44KB
MD5

f1a1c11ab4cc45bac3e1e92e2875aad0
SHA1

9ad4f8a0f7b6fe010fafdeb38cee3a838d1170b2
SHA256

da723591653eed629452ec3ee217a897296ccaca1bb5fae8dceb8ae3a855c352
SHA512

dda78eb0d1560f91222497c37081a98718ed36aef197e60798924aed7a78c546d126028f10410eca9fc2e9f835131359b7bc1b60ee982023a7df4aae9e5171ec
SSDEEP

768:wEsWg8F9QNZF0GvuhSnZ6ttEre9cTnjGa3yMuoIfopzZYiCG1voN6:xsd8zcZqSZfrA4n6a3yXw4UVE6

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 4860	2092	rundll32.exe	82
PID 2092 wrote to memory of 4860	2092	rundll32.exe	82
PID 2092 wrote to memory of 4860	2092	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f1a1c11ab4cc45bac3e1e92e2875aad0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f1a1c11ab4cc45bac3e1e92e2875aad0_JaffaCakes118.dll,#1
  2⤵
  PID:4860

memory/4860-0-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download
memory/4860-1-0x0000000000850000-0x000000000085A000-memory.dmp

Filesize
40KB

Download