f67bdc63385f4edd1db847392b55d9e5a21397cfe69ba3d3e77317d92ab12b17

Analysis

max time kernel
67s
max time network
49s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 16:53

Target

013949e85d5aa0498e9ccfd69813ee84_JaffaCakes118.dll
Size

5KB
MD5

013949e85d5aa0498e9ccfd69813ee84
SHA1

0b1fe922af1f7b0a36479b3ab4a2dd7af4e52dc4
SHA256

f67bdc63385f4edd1db847392b55d9e5a21397cfe69ba3d3e77317d92ab12b17
SHA512

2820f3710e300326280dcf99d3b7b270489dfb18127a8ff3dab7721523d3236d8ce14add94609f8c187e0e24922f5a4ffe2f356af2112adb8ac60505e2fd357c
SSDEEP

96:EOBFqD88h3ufuVrYBjAPltste/hI1knzmcfnp3N:xF/8hefuVris9tIahsSqYp

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 3064	4864	rundll32.exe	84
PID 4864 wrote to memory of 3064	4864	rundll32.exe	84
PID 4864 wrote to memory of 3064	4864	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\013949e85d5aa0498e9ccfd69813ee84_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\013949e85d5aa0498e9ccfd69813ee84_JaffaCakes118.dll,#1
  2⤵
  PID:3064

memory/3064-0-0x0000000063AC0000-0x0000000063AC9000-memory.dmp

Filesize
36KB

Download