6a09d5cd9c839868af56e8917fc4fe2314e5c9e60772cc7377cd8270e2c527dc

Analysis

max time kernel
94s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 13:59

Target

f825a73f485653d18fa7865191c5634e_JaffaCakes118.dll
Size

612KB
MD5

f825a73f485653d18fa7865191c5634e
SHA1

d640f3823d683fd767ae3555229871156c25fc1c
SHA256

6a09d5cd9c839868af56e8917fc4fe2314e5c9e60772cc7377cd8270e2c527dc
SHA512

e8776c00366afc213872060848bd65ce5caf52b8cb619d76b48e3119b14159a850a51ca869b2826b9e27a8f1c78d6f8c563f54d33441a122aaf529530b7f1c07
SSDEEP

12288:y4O3liJG1PmeeVByRP8I6oH4M21AMMJypUrmhZNsy0PKoGcLszGVvcfRY:y4EQHxQkI6q4M229JqUrmHNsyiKHSUfR

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 4392	4188	rundll32.exe	83
PID 4188 wrote to memory of 4392	4188	rundll32.exe	83
PID 4188 wrote to memory of 4392	4188	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f825a73f485653d18fa7865191c5634e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f825a73f485653d18fa7865191c5634e_JaffaCakes118.dll,#1
  2⤵
  PID:4392

memory/4392-0-0x0000000075520000-0x0000000075697000-memory.dmp

Filesize
1.5MB

Download