6abd57dd92370b1a6f82eefcb9f02dea13cd29ec3b7402640038112e3c5a0538

Analysis

max time kernel
66s
max time network
57s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 06:49

Target

02a9318c1fba4dd01a7260a6344711ae_JaffaCakes118.dll
Size

41KB
MD5

02a9318c1fba4dd01a7260a6344711ae
SHA1

f3f9f36166dda5d623b6efc45a6e059a17549b3d
SHA256

6abd57dd92370b1a6f82eefcb9f02dea13cd29ec3b7402640038112e3c5a0538
SHA512

6eec7250b1df698824a7ee680911a4c903caf158e0c0e91113123312a47f821bb9ebdd4c2b19eb4aafb817b2f8e6e0ec00f563ce11f3e1f3526434823f7ebcb0
SSDEEP

768:PgDuJIZmYv9DwY5FWxZ9DLxAh6V6SIAYa0aX4M0MwI40pvuc14Pop1al7DM:oDtZmU9UkFoZ9nxAA6DZMRp9JSy

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 1856	2924	rundll32.exe	83
PID 2924 wrote to memory of 1856	2924	rundll32.exe	83
PID 2924 wrote to memory of 1856	2924	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\02a9318c1fba4dd01a7260a6344711ae_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\02a9318c1fba4dd01a7260a6344711ae_JaffaCakes118.dll,#1
  2⤵
  PID:1856

memory/1856-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download