6512dd89c6f585c628fdfb7333e7d8fa0cd6a65d7be01d419ee77386d4d6bee2

Analysis

max time kernel
135s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 04:48

Target

6d6141f1d7213a150248ecc117215747_JaffaCakes118.dll
Size

49KB
MD5

6d6141f1d7213a150248ecc117215747
SHA1

6fe0901cacaa727ec8dab90daca764d2d3cb43fb
SHA256

6512dd89c6f585c628fdfb7333e7d8fa0cd6a65d7be01d419ee77386d4d6bee2
SHA512

36f826b5f797551de5f2961f612356b3fc6cbe8a9b0b3945ef32cfaa0576451cf70061c19aee59d2f4a9894f05ac1a706e45e9d7932db9736d4cb0103adac97c
SSDEEP

768:OB5UUtABDOb1DGIAqND4ukmYNZIffIm2M6rSjBTfMbY/HshrmjwoC49fUJ7D:oUWAlOpDZp9kgXp+rSj5MbqshKfD2

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 228 wrote to memory of 1836	228	rundll32.exe	83
PID 228 wrote to memory of 1836	228	rundll32.exe	83
PID 228 wrote to memory of 1836	228	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6d6141f1d7213a150248ecc117215747_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:228
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6d6141f1d7213a150248ecc117215747_JaffaCakes118.dll,#1
  2⤵
  PID:1836

memory/1836-0-0x0000000062CB0000-0x0000000062CDC000-memory.dmp

Filesize
176KB

Download