dc5a62588453605409454aa72798250d6db6f090dd76fd662ab20f746a8d3085

Analysis

max time kernel
91s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 01:14

Target
a3514d66b51ab3963b543b5a1ed909c1_JaffaCakes118.dll
Size 384KB
Sample240613-blybxssdmk
SHA256 dc5a62588453605409454aa72798250d6db6f090dd76fd662ab20f746a8d3085
MD5 a3514d66b51ab3963b543b5a1ed909c1
SHA1 d93ec10929772a40c7ddc5fe5b19622b4e59196c
SHA512 5270862e785ac3ff69edfcf5801266436a67508c96ee9e5f5ea3cebde1f536cd86f2d0ce2cf0ef68f3e3475781da28dfb5ccea45d306038331b206503ba6d640
SSDEEP 6144:QngfSSiWNePIlJJRV/sieP32lm37LzgmIKJ:QncSShNePIbJbGK0zT9
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4496 wrote to memory of 684	4496	rundll32.exe	82
PID 4496 wrote to memory of 684	4496	rundll32.exe	82
PID 4496 wrote to memory of 684	4496	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3514d66b51ab3963b543b5a1ed909c1_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3514d66b51ab3963b543b5a1ed909c1_JaffaCakes118.dll,#1
  2⤵
  PID:684

memory/684-0-0x0000000074AA0000-0x0000000074B2C000-memory.dmp

Download