7a7b957bbd4e43a49fa23f46e2de187a464218927266597b4517c067be34035e

Analysis

max time kernel
142s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18-04-2024 18:16

Target

f88180b9b6217ea3e15133154ceba529_JaffaCakes118.dll
Size

72KB
MD5

f88180b9b6217ea3e15133154ceba529
SHA1

f21abcb309fb870dadbde3701e9f471c36530ff2
SHA256

7a7b957bbd4e43a49fa23f46e2de187a464218927266597b4517c067be34035e
SHA512

0d9b7ad86c076b8d70c0d4a6adc1836203d883d5fdb49815ef942560e6110959b80f820e6d652e00532d73149e8bb4bf119d75802acfda2ddf4de6478305cc38
SSDEEP

1536:Y56SWOn7l2pJW6GJUrtUZB0wBIkjToBwxLrn2QUbT+uj:I6fOn7lYJiUrt6ywrfoBwRn2QUGu

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 2756	1996	rundll32.exe	84
PID 1996 wrote to memory of 2756	1996	rundll32.exe	84
PID 1996 wrote to memory of 2756	1996	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f88180b9b6217ea3e15133154ceba529_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f88180b9b6217ea3e15133154ceba529_JaffaCakes118.dll,#1
  2⤵
  PID:2756

memory/2756-0-0x0000000000BC0000-0x0000000000BCA000-memory.dmp

Filesize
40KB

Download
memory/2756-2-0x0000000010000000-0x0000000010009000-memory.dmp

Filesize
36KB

Download