fd4d98d11f4ab42f1989abb90dd31a0c9202cd98b78131f792b5f7b7c966d1ed

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19/06/2024, 23:07

Target

010fe3770b17800bf83ab37454d91549_JaffaCakes118.dll
Size

2.2MB
MD5

010fe3770b17800bf83ab37454d91549
SHA1

b49359ca30923cb4483b16c9b6451874af193939
SHA256

fd4d98d11f4ab42f1989abb90dd31a0c9202cd98b78131f792b5f7b7c966d1ed
SHA512

e26830eb907a204592fedf8263acdae2a741738e8bbf377e9af813208f1f9b89b55972243a2e62049c66013b09b04d6ee073607321cc576f52ba29ba4ef45a37
SSDEEP

49152:+X59ZZaNeLut/MAyVOr6kcXMfKAfqNMP9Pyz6DMPCMTbzw:a59PaNe4/wsr6kcXv69PvQP1U

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4944 wrote to memory of 1876	4944	rundll32.exe	82
PID 4944 wrote to memory of 1876	4944	rundll32.exe	82
PID 4944 wrote to memory of 1876	4944	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\010fe3770b17800bf83ab37454d91549_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\010fe3770b17800bf83ab37454d91549_JaffaCakes118.dll,#1
  2⤵
  PID:1876

memory/1876-0-0x0000000010000000-0x0000000010009000-memory.dmp

Filesize
36KB

Download