2be5aa1a9ddc6e987e71cb0ba2e1f1344c95198ac94a7263aba7efc867cb27bc

Analysis

max time kernel
139s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 11:38

Target

6328011b17927c5c26f938e08aed5200_JaffaCakes118.dll
Size

28KB
MD5

6328011b17927c5c26f938e08aed5200
SHA1

d1ea0c5ef076751a4cd46a7d308cbe2232426208
SHA256

2be5aa1a9ddc6e987e71cb0ba2e1f1344c95198ac94a7263aba7efc867cb27bc
SHA512

73f421b97915ac343a5e0fed6619540fd31817c9beb4c54637b8978080af84d56256bfac75b4332fbdf85ef767f8fff9b8ae5e8c9fcbdd6be165628bbe9590e7
SSDEEP

768:gylOxeIspbXXoeeeAbc2+Dx/vgGBfypn+B4Ca7DmV:gyIxRmXoeeQzBfy8BHV

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 4936	4608	rundll32.exe	83
PID 4608 wrote to memory of 4936	4608	rundll32.exe	83
PID 4608 wrote to memory of 4936	4608	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6328011b17927c5c26f938e08aed5200_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6328011b17927c5c26f938e08aed5200_JaffaCakes118.dll,#1
  2⤵
  PID:4936

memory/4936-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download