2ee1a6856163f8b3477659e9d787a8fd5796df896ec83dbf1521fa77c0112511

Analysis

max time kernel
52s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20-06-2024 00:37

Target

017740ea4e858977404ab4716b964538_JaffaCakes118.dll
Size

15KB
MD5

017740ea4e858977404ab4716b964538
SHA1

281c67bd679004eb0c7ca54534fc3c18227915b8
SHA256

2ee1a6856163f8b3477659e9d787a8fd5796df896ec83dbf1521fa77c0112511
SHA512

5f46b1aa85d8245eed3a7e9dbaf0ae490f78b88d3dcaaf58494a2c430e64d6846aabd53025ce80e7494c9be50dfa12c10cf02e92049e7f6bf1c7cd71e3573621
SSDEEP

384:Y6oAsYk9b8x894A+l/49eXb8vlrh49pCMFGT/NzWj:pw1b8W94XVlMO9NmG

Score

1^/10

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
656	Process not Found

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 4000	4352	rundll32.exe	81
PID 4352 wrote to memory of 4000	4352	rundll32.exe	81
PID 4352 wrote to memory of 4000	4352	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\017740ea4e858977404ab4716b964538_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\017740ea4e858977404ab4716b964538_JaffaCakes118.dll,#1
  2⤵
  PID:4000

memory/4000-1-0x0000000025000000-0x0000000025020000-memory.dmp

Filesize
128KB

Download