f2d46fd499f683e61f377484ea4899e2356db01df551f92cbb0b97919f309165

Analysis

max time kernel
94s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 09:08

Target
913b3a961f248bbd2e2b9657295c8170_JaffaCakes118.dll
Size 23KB
Sample240603-k38cwsba62
SHA256 f2d46fd499f683e61f377484ea4899e2356db01df551f92cbb0b97919f309165
MD5 913b3a961f248bbd2e2b9657295c8170
SHA1 3f09172054f28115a8e528d68905c3530f1483b1
SHA512 d1ee3c95ec9723242838544991084109c1855d2b3d910edd8aa0dd18b24e8ae62e7e977811ee48fab6359506f5ab92109682801ee9cc611264cf69f5bfeb8fb1
SSDEEP 384:KfZcOnfNGBASbpoOdQSR3MKYsmcFHdDx0vyXutCIFEF4d2eIeV6jO:fmfhSbuOdRNMKYsmGHVxUtFck2eI4GO
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 4636	956	rundll32.exe	81
PID 956 wrote to memory of 4636	956	rundll32.exe	81
PID 956 wrote to memory of 4636	956	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\913b3a961f248bbd2e2b9657295c8170_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\913b3a961f248bbd2e2b9657295c8170_JaffaCakes118.dll,#1
  2⤵
  PID:4636

memory/4636-0-0x0000000010000000-0x000000001000A000-memory.dmp

Download