199bce59776d2ca4a703b11fb149e2225478d1fa780ae476111767ba11e561cf

Analysis

max time kernel
129s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 15:38

Target
924b3bc28eca8d07943f57ba69b91e58_JaffaCakes118.dll
Size 13KB
Sample240603-s2167acc74
SHA256 199bce59776d2ca4a703b11fb149e2225478d1fa780ae476111767ba11e561cf
MD5 924b3bc28eca8d07943f57ba69b91e58
SHA1 0aeba64614383d23d2e25dee434b459ccaec8b50
SHA512 4a72ff8f08cd4b04efeb69f7a2c4dd5e5186cca1f51c2ea195f28bf9a6e40835de34cee9c4058973f59dd5f9cc9a64b248bc74f840d7d6df6c4e1d88e33a6889
SSDEEP 384:OGH7f+KfKt8bcWil8WT1H5L30Yp7WJBWn:OAf+KqEcWC8WT1Zz0Fu
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 872	2236	rundll32.exe	83
PID 2236 wrote to memory of 872	2236	rundll32.exe	83
PID 2236 wrote to memory of 872	2236	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\924b3bc28eca8d07943f57ba69b91e58_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\924b3bc28eca8d07943f57ba69b91e58_JaffaCakes118.dll,#1
  2⤵
  PID:872

memory/872-0-0x0000000066430000-0x000000006643B000-memory.dmp

Download