d53f0a05ee0708b03fb855f43bca40e39e81d81aaf3413c1c74949d1c8f29138

Analysis

max time kernel
134s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 01:02

Target

f6f4833c88688e12875acecc5aefad16_JaffaCakes118.dll
Size

89KB
MD5

f6f4833c88688e12875acecc5aefad16
SHA1

fb00bb8d792e635c55c0b28f98ee5c35c64ac936
SHA256

d53f0a05ee0708b03fb855f43bca40e39e81d81aaf3413c1c74949d1c8f29138
SHA512

b2c862d9ad893ad00174fbe99a03669a6e739b68462127d25e51ba2cdba75ceec2b0d6859f1cbe97260c087cec15daf167ab844e310183a24ca44e67d6f314c5
SSDEEP

1536:oqqAF4zlm2qUrLOJI2mirnT8unfK+VfCJbuzk+JOUZcImkPtlv2oI6/x/mV3:vB2DrLOJIpiouCVJaz55ZcyttIj3

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 2500	1700	rundll32.exe	87
PID 1700 wrote to memory of 2500	1700	rundll32.exe	87
PID 1700 wrote to memory of 2500	1700	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f6f4833c88688e12875acecc5aefad16_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f6f4833c88688e12875acecc5aefad16_JaffaCakes118.dll,#1
  2⤵
  PID:2500

memory/2500-0-0x0000000010000000-0x0000000010058000-memory.dmp

Filesize
352KB

Download