c29f7be1aabdc2df8659fbdc31b4a350766a21e1a2bad859a3e161f845c45714

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
19/06/2024, 23:58

Target

014f9f84f72c5457f2f9510c6e7331e8_JaffaCakes118.dll
Size

41KB
MD5

014f9f84f72c5457f2f9510c6e7331e8
SHA1

f4cb3c52ffd1957655897b570af463c8b3700386
SHA256

c29f7be1aabdc2df8659fbdc31b4a350766a21e1a2bad859a3e161f845c45714
SHA512

5dbd33a20dbbba7bcf026527b129dcc59571348b702bd476c9dcbe6bfe72a77888aab5dfbe39d0c375a366fb711725f27d678d9476280b930505f102f6cb5983
SSDEEP

768:79ASu+fPFFR+twkG2Ht7ZaWmldBbOMHnuqEXBcV5t6eDYYPdMHg8:6B+fPrQwp6tXUdBqMHnGuXt6epdMHg8

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 936	4732	rundll32.exe	82
PID 4732 wrote to memory of 936	4732	rundll32.exe	82
PID 4732 wrote to memory of 936	4732	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\014f9f84f72c5457f2f9510c6e7331e8_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\014f9f84f72c5457f2f9510c6e7331e8_JaffaCakes118.dll,#1
  2⤵
  PID:936

memory/936-0-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download