138baf4917a96b98d675791866e75bfa7b21a648b67c313d8a835351a13cf753

Analysis

max time kernel
92s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 11:09

Target
808968b7f72d262159d7bfb87455aafe_JaffaCakes118.dll
Size 322KB
Sample240529-m86glace5t
SHA256 138baf4917a96b98d675791866e75bfa7b21a648b67c313d8a835351a13cf753
MD5 808968b7f72d262159d7bfb87455aafe
SHA1 05a57d4cb2c5b18da5e2a13a0fb441390bda97bb
SHA512 e8e429969d3606e952a0441caa481e1a8c3a2fa945d39949d25183f28f6efa266feff206266b4e77449199f34a1202332facf1a68d085f0809102567d319fbc2
SSDEEP 6144:OCF51Nzf5pRZUflCHtD/TpvAenYzAtvgulPd91iQja+fwjmrSpm4WU4r:NF5vPRZSCHt79INzArdPnjxcmrym4WZr
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 2980	2992	rundll32.exe	81
PID 2992 wrote to memory of 2980	2992	rundll32.exe	81
PID 2992 wrote to memory of 2980	2992	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\808968b7f72d262159d7bfb87455aafe_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\808968b7f72d262159d7bfb87455aafe_JaffaCakes118.dll,#1
  2⤵
  PID:2980

memory/2980-0-0x000000001B6D0000-0x000000001B7A3000-memory.dmp

Download