67e41c30fa91464f7fb44ecc6853474503ae47fd491002f71560ce1f9e5be58f

Analysis

max time kernel
138s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16-05-2024 19:40

Target

4cbd728bd55ddd5f497c1dc8a0551d44_JaffaCakes118.dll
Size

52KB
MD5

4cbd728bd55ddd5f497c1dc8a0551d44
SHA1

aa6acd24de509d3c0ec6c4ee648d3a74b5bc53f2
SHA256

67e41c30fa91464f7fb44ecc6853474503ae47fd491002f71560ce1f9e5be58f
SHA512

40e6e91122a828fe4acbe86c38037219de347d2e8fbfd04ad65b5a544b744e4a35a471b7e511c10c5fadbdec773a011c841751e499d3eef933ea38df058ee96e
SSDEEP

1536:hSQ7KI5QZMzbUaZQr6LKdA1HvzRPboraOe6:ZuIu6SmKgdPbpO9

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 1680	2148	rundll32.exe	82
PID 2148 wrote to memory of 1680	2148	rundll32.exe	82
PID 2148 wrote to memory of 1680	2148	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4cbd728bd55ddd5f497c1dc8a0551d44_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4cbd728bd55ddd5f497c1dc8a0551d44_JaffaCakes118.dll,#1
  2⤵
  PID:1680

memory/1680-0-0x000000006C080000-0x000000006C0A5000-memory.dmp

Filesize
148KB

Download