789f17526e766f92c7625724f13df96f5dec99983ff9b99703054e4a5a9369f1

Analysis

max time kernel
146s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20/04/2024, 00:36

Target

fb8665612d9c53707cd5a4108442de83_JaffaCakes118.dll
Size

18KB
MD5

fb8665612d9c53707cd5a4108442de83
SHA1

379656bfb0bdbcae9116d4e561b6d0d17414a4e3
SHA256

789f17526e766f92c7625724f13df96f5dec99983ff9b99703054e4a5a9369f1
SHA512

5a050b224eece84c52594d4e5dafe7224d5353bc32feacbdfd497a9420981dfd80a3c04120a38139d0a1e0be199d168b6d7d125ee5139499ede7f24ed86d5d4d
SSDEEP

384:rGifk5JNMvnyLR8jv5w3KMquEUwIz7U5p3oE1Q9R/pzgvxcztpJsU:CEk5JUn2ahw3KMquEURz7Un3o8Q9R/1v

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 2892	4796	rundll32.exe	86
PID 4796 wrote to memory of 2892	4796	rundll32.exe	86
PID 4796 wrote to memory of 2892	4796	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb8665612d9c53707cd5a4108442de83_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb8665612d9c53707cd5a4108442de83_JaffaCakes118.dll,#1
  2⤵
  PID:2892

memory/2892-0-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download