d075b5f98414b6ff7ef52e1d1aacd051b931b2a2572dfd8326ffd2b5edc5933f

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20/04/2024, 05:44

Target

fc0d73956f9065a6766e051ee79afe92_JaffaCakes118.dll
Size

104KB
MD5

fc0d73956f9065a6766e051ee79afe92
SHA1

c813b107627dd37b92b6ac9f65dc9037437a1c2f
SHA256

d075b5f98414b6ff7ef52e1d1aacd051b931b2a2572dfd8326ffd2b5edc5933f
SHA512

a83b270aea039d5106638903b007e1ea18526d4b8ae72fdb2dcb792d28d81113490a8f62ebd734125b229c1e3cf2708091a5413402a1dcf4a50d08efaa3d92c9
SSDEEP

3072:CjjonaqISR/8GTW68uLMLHM0WxvWOxwJpjLXT8lH:CPonaqr/9W6fLMLH4YOxUpjLXT8

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 5012	1468	rundll32.exe	85
PID 1468 wrote to memory of 5012	1468	rundll32.exe	85
PID 1468 wrote to memory of 5012	1468	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fc0d73956f9065a6766e051ee79afe92_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fc0d73956f9065a6766e051ee79afe92_JaffaCakes118.dll,#1
  2⤵
  PID:5012

memory/5012-0-0x00000000008E0000-0x00000000008EA000-memory.dmp

Filesize
40KB

Download
memory/5012-3-0x0000000010000000-0x0000000010025000-memory.dmp

Filesize
148KB

Download