c5a7ce0b15018116746ffc23731f77b8c19ce2addc0aedce2d2b8c2e360faaeb

Analysis

max time kernel
51s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16-06-2024 06:46

Target

b23292d506642d8d7493bc00f322c69e_JaffaCakes118.dll
Size

73KB
MD5

b23292d506642d8d7493bc00f322c69e
SHA1

e1c87bc9eddbbebb53f46370489ad872a9b7c3a8
SHA256

c5a7ce0b15018116746ffc23731f77b8c19ce2addc0aedce2d2b8c2e360faaeb
SHA512

1346860b27529ce2b96eb1975979aa333c490960c57f71c64128ac6470b0f7f0733671062061790dce9915da42f7a58182b9396c30e3090ce7edfb70f70faaa9
SSDEEP

1536:bqzzWbrbUnAU30BpysLwX2UR7nDs8BHUBiEykVv41DpgU:0zWbHUDK8sLS2YjA8VUB9yk541DpX

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 4548	1048	rundll32.exe	80
PID 1048 wrote to memory of 4548	1048	rundll32.exe	80
PID 1048 wrote to memory of 4548	1048	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b23292d506642d8d7493bc00f322c69e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b23292d506642d8d7493bc00f322c69e_JaffaCakes118.dll,#1
  2⤵
  PID:4548

memory/4548-1-0x00000000006E0000-0x00000000006E1000-memory.dmp

Filesize
4KB

Download
memory/4548-0-0x0000000010000000-0x000000001002A000-memory.dmp

Filesize
168KB

Download