15505624d3e5dcbcb28c1773bcc0446a36e1ced5160f6573bfcc9a73ecccd558

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 22:08

Target

f6acea5917d9352e1b17e9af3e23c03b_JaffaCakes118.dll
Size

15KB
MD5

f6acea5917d9352e1b17e9af3e23c03b
SHA1

7722854534963df1b5a06dab2907f8828a56c062
SHA256

15505624d3e5dcbcb28c1773bcc0446a36e1ced5160f6573bfcc9a73ecccd558
SHA512

791d786b9c7cd0aab1734317dc645165ce821bc7793be5223425b04b88d2d391a5fa531e70c1232c5910b096e333d69c0b63984f9848ec13f43625526d17c7b8
SSDEEP

384:8gxKwOVvz65yUs7AZ3p7SMhehQkeujXTpWGXm1e1U:8lPVrVUsop7h8dH5Xm1e1U

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 468	1900	rundll32.exe	83
PID 1900 wrote to memory of 468	1900	rundll32.exe	83
PID 1900 wrote to memory of 468	1900	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f6acea5917d9352e1b17e9af3e23c03b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f6acea5917d9352e1b17e9af3e23c03b_JaffaCakes118.dll,#1
  2⤵
  PID:468

memory/468-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/468-1-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

Filesize
4KB

Download