138a6cd2f64c59c4cf7c023cbe91d09d91ce4d45da2e403918318cb9ccd87e36

Analysis

max time kernel
133s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 22:28

Target

99673b44dc771ffdeb4feebc6bcb1fa2_JaffaCakes118.dll
Size

38KB
MD5

99673b44dc771ffdeb4feebc6bcb1fa2
SHA1

71ffa8f6f87403e612a275a9515ad044b949d9b4
SHA256

138a6cd2f64c59c4cf7c023cbe91d09d91ce4d45da2e403918318cb9ccd87e36
SHA512

102ec1b807b4afa689b922c459b666304368f331cb92b9aa09488a2750be66036a216fdedb6c065c593c3fbdf315da35180342c50906c154e7700e8f2315d41d
SSDEEP

768:PK123msI2wufyud1hinmv8R9RjurqVTmzCYZa6a/WiXTvF7DsP:Lmsx11Mmm9tsCTmuScFjvOP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 5036	5104	rundll32.exe	83
PID 5104 wrote to memory of 5036	5104	rundll32.exe	83
PID 5104 wrote to memory of 5036	5104	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\99673b44dc771ffdeb4feebc6bcb1fa2_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\99673b44dc771ffdeb4feebc6bcb1fa2_JaffaCakes118.dll,#1
  2⤵
  PID:5036

memory/5036-0-0x0000000074D40000-0x0000000074D58000-memory.dmp

Filesize
96KB

Download