3273469ad84844e01e3996e7019c69b60825dea48591569e5d3ac7751008fa97

Analysis

max time kernel
93s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 08:14

Target

800ff7ac8e7be68f2dba633d81b08f04_JaffaCakes118.dll
Size

22KB
MD5

800ff7ac8e7be68f2dba633d81b08f04
SHA1

8d443852d99051322fbfa12f4ba564b60f9c7ca5
SHA256

3273469ad84844e01e3996e7019c69b60825dea48591569e5d3ac7751008fa97
SHA512

ce811ff998726c3b68cdcb7ec35585b9718177f463feadce465e9347e8ee71e61cc7feb307074cd3e1ef05224785e355071ee93129b2412813342a9e91c819c6
SSDEEP

384:xJDftelY4rjQzK2Xx9fm3QtJMcUXVPr/ceM7JMY4XN2EDQXUXVPr/k6R:HftSZr72BUZB7JY48Ed7k6R

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 4788	1164	rundll32.exe	83
PID 1164 wrote to memory of 4788	1164	rundll32.exe	83
PID 1164 wrote to memory of 4788	1164	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\800ff7ac8e7be68f2dba633d81b08f04_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1164
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\800ff7ac8e7be68f2dba633d81b08f04_JaffaCakes118.dll,#1
  2⤵
  PID:4788

memory/4788-0-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download