103445c1ba5ce66d878e1fe2ac29046e03ea8320d4d7b94f82cfef5026d9a8e5

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11-05-2024 16:50

Target

35957e03d264a8c417ada5cafe27b062_JaffaCakes118.dll
Size

31KB
MD5

35957e03d264a8c417ada5cafe27b062
SHA1

683387daad756fc4a5141eec52778dd444602afc
SHA256

103445c1ba5ce66d878e1fe2ac29046e03ea8320d4d7b94f82cfef5026d9a8e5
SHA512

f7694161c7f956ed7329d7032853b5e3329718f4a0ddef2088054b7e1f0f476af419fe27ac69ae4e2c351f681660e3ea274f9d87983480f09ecb295c6bb5a840
SSDEEP

384:zopq6ELsfpZQuzsJKlqwe7JzkgTljbqgPFYERVeP8yjfcYb4KGgU8h/NOHkEMMe:zo46l1Q2GkgTdNPFHDofb4gDh/4BHe

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 3008	3980	rundll32.exe	81
PID 3980 wrote to memory of 3008	3980	rundll32.exe	81
PID 3980 wrote to memory of 3008	3980	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\35957e03d264a8c417ada5cafe27b062_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\35957e03d264a8c417ada5cafe27b062_JaffaCakes118.dll,#1
  2⤵
  PID:3008

memory/3008-0-0x0000000074A10000-0x0000000074A1A000-memory.dmp

Filesize
40KB

Download