9ad4483f4326d410cc39748c1268194ddb373dbde52da97b0145de302a82e9ff

Analysis

max time kernel
92s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 16:09

Target
9263d3b6f297ba2b6bdcc7f349821a35_JaffaCakes118.dll
Size 8KB
Sample240603-tl44ksda96
SHA256 9ad4483f4326d410cc39748c1268194ddb373dbde52da97b0145de302a82e9ff
MD5 9263d3b6f297ba2b6bdcc7f349821a35
SHA1 f363d1cbf8eaf33ee57d3cb28abf890838680816
SHA512 da81ac7dc94fe7f85d8074f7bcfec86f347c0c7d51711beb51cf7ce5b4af99c85a2c3188e6625107f3b1a080be81a62c8a56e80ef13b41df7fe8b3164479da43
SSDEEP 192:2UuBG674L3XjypLfe9ZHzK1w4Czc7YLoBYp1WlDWn:2UuD74L3mpLfCZGwgYcBYp1WlDWn
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 3400	2544	rundll32.exe	82
PID 2544 wrote to memory of 3400	2544	rundll32.exe	82
PID 2544 wrote to memory of 3400	2544	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9263d3b6f297ba2b6bdcc7f349821a35_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9263d3b6f297ba2b6bdcc7f349821a35_JaffaCakes118.dll,#1
  2⤵
  PID:3400

memory/3400-0-0x0000000066C10000-0x0000000066C19000-memory.dmp

Download