c31680ff68312645f7a824544082f18f6c46372e2807bcfd18922291e9dd406a

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20/04/2024, 08:48

Target

fc6024194a74a46126e353adbf4d4886_JaffaCakes118.dll
Size

253KB
MD5

fc6024194a74a46126e353adbf4d4886
SHA1

155a76de894d7b717d2df225c4c478631d30b190
SHA256

c31680ff68312645f7a824544082f18f6c46372e2807bcfd18922291e9dd406a
SHA512

391bae7a908cff21f8c6a2a33bf63e46ff7a19ba9dc8146e0843bc4d8b86de1d425f17606bd33d1d1f789581cb343672c50f0480dbcadee8742a12f4fbd194e3
SSDEEP

6144:JBuEJjuvWxldjWUou3UWMehOZf9PlqqD8y4Gstd50:+EJjuvWxldjWV63hWfNIqIyho50

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 4396	2244	rundll32.exe	84
PID 2244 wrote to memory of 4396	2244	rundll32.exe	84
PID 2244 wrote to memory of 4396	2244	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fc6024194a74a46126e353adbf4d4886_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fc6024194a74a46126e353adbf4d4886_JaffaCakes118.dll,#1
  2⤵
  PID:4396

memory/4396-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download