5dcda73f00a6b5aaadc50f3a2d8d536ef7ce123577d98b686b371d6c7aea9093

Analysis

max time kernel
138s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 12:24

Target

71f0bd5119e5696538e838ad01842cbf_JaffaCakes118.dll
Size

8KB
MD5

71f0bd5119e5696538e838ad01842cbf
SHA1

082275560defdda9d439aabc1ce201e90702ce11
SHA256

5dcda73f00a6b5aaadc50f3a2d8d536ef7ce123577d98b686b371d6c7aea9093
SHA512

b73622520a3f724844ee9d2d0a72340b8dbb4720b23fe2bf99c14c6bed980ce5a6b2eb7654f45f2c1a02ce307c97546da13a306cfae7ffc4235ec2c7e7b712e3
SSDEEP

192:qqPX8E5ysHkEkJvJZpKuvriHPTGjPfu89QjVwbXIBP6WYp:fPsEMsgXrKuvrivij289QjVM4Yp

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 1688	1492	rundll32.exe	83
PID 1492 wrote to memory of 1688	1492	rundll32.exe	83
PID 1492 wrote to memory of 1688	1492	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\71f0bd5119e5696538e838ad01842cbf_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\71f0bd5119e5696538e838ad01842cbf_JaffaCakes118.dll,#1
  2⤵
  PID:1688

memory/1688-0-0x000000006DB00000-0x000000006DB0D000-memory.dmp

Filesize
52KB

Download