f9af1fbe9ec7525d396146a0df584a050056a3cddf9df580dca042ca2a0e0347

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 00:24

Target

f9173d09659476b7073ded270493fbb6_JaffaCakes118.dll
Size

35KB
MD5

f9173d09659476b7073ded270493fbb6
SHA1

ff5de2611e2a51532caaa2059bdc63e887e0bd06
SHA256

f9af1fbe9ec7525d396146a0df584a050056a3cddf9df580dca042ca2a0e0347
SHA512

9e2b13b0c293af57c6eeb4dedf7cd1c4741eddd01d2c74f632c99b85ef99c949239d004b43c80702da1ed523bdeb38a8367f4381a2f1c0285c6a14e3694b4c3b
SSDEEP

768:mWjChIUizxXVAe4JsrPXVcaICAz5oqe6DCLVccriPqN4MAJVovy62e1XC:hCh/gNNACAWn6D2+criPbX8v3XC

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 4084	1320	rundll32.exe	84
PID 1320 wrote to memory of 4084	1320	rundll32.exe	84
PID 1320 wrote to memory of 4084	1320	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f9173d09659476b7073ded270493fbb6_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f9173d09659476b7073ded270493fbb6_JaffaCakes118.dll,#1
  2⤵
  PID:4084

memory/4084-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/4084-1-0x0000000000EB0000-0x0000000000EB4000-memory.dmp

Filesize
16KB

Download