9c2cc47ff43ed69ab09232608c0bd878d8e60f634ce47d8b3bbd05d0bd1fab46

Analysis

max time kernel
145s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
21-04-2024 11:14

Target

ff27a046a307b5aeeb614b665faaf9f5_JaffaCakes118.dll
Size

18KB
MD5

ff27a046a307b5aeeb614b665faaf9f5
SHA1

d1502f4d852fdf74c7b8f11d7980c5c9cddcd57d
SHA256

9c2cc47ff43ed69ab09232608c0bd878d8e60f634ce47d8b3bbd05d0bd1fab46
SHA512

0dfef35dd684f2e0227147a892c544e093dd556e2a9c5d36a650e217b5b41e0d77b8807cb82c120ece0bb53dc01759973498146afde69271e9eebd6484d9c8a0
SSDEEP

192:FM5M5Qy/f4KJ5LxRN+9qwN5RU4PgCg3leYzTxpo38IoCfE7:iolJ5LHNaXU0cVeY/xpo38IffE7

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 3464	1540	rundll32.exe	87
PID 1540 wrote to memory of 3464	1540	rundll32.exe	87
PID 1540 wrote to memory of 3464	1540	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ff27a046a307b5aeeb614b665faaf9f5_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ff27a046a307b5aeeb614b665faaf9f5_JaffaCakes118.dll,#1
  2⤵
  PID:3464

memory/3464-0-0x000000006F9C0000-0x000000006F9C7000-memory.dmp

Filesize
28KB

Download