e78d09ce890d86d608466ad3c63d42ff88d6764bd90e87b3142b91cdf008f8c1

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 00:07

Target

fb78ab2b5f79a86527db6b09f86e1456_JaffaCakes118.dll
Size

56KB
MD5

fb78ab2b5f79a86527db6b09f86e1456
SHA1

56afe96200bc74068b8cea56a93714cb9dc0a7e4
SHA256

e78d09ce890d86d608466ad3c63d42ff88d6764bd90e87b3142b91cdf008f8c1
SHA512

a3b67726b2e14724d216dcfde3a7347ad5b47631c34d10ea28a09445a55378a05e467380ed747dc1074cf556cf978ff9d994930e141b44ca7c88133c823eb6cd
SSDEEP

768:s/XVBm4CjxKQfgsbcoPxVjy2YWhIazCWtppp1oHVXni1pflhfyvXumAw:4yhtKQIaf4hazCWjgV3gfr4XSw

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1696 wrote to memory of 5108	1696	rundll32.exe	rundll32.exe
PID 1696 wrote to memory of 5108	1696	rundll32.exe	rundll32.exe
PID 1696 wrote to memory of 5108	1696	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb78ab2b5f79a86527db6b09f86e1456_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb78ab2b5f79a86527db6b09f86e1456_JaffaCakes118.dll,#1
  2⤵
  PID:5108

memory/5108-0-0x0000000000BC0000-0x0000000000BC9000-memory.dmp

Filesize
36KB

Download