2d573e392c6c5ef71a6e94f5f7965557f42adca005e3eb6723c1f14f5e4ea396

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 02:18

Target

01fc20e3188ec0b39c6a26f031f77b05_JaffaCakes118.dll
Size

443KB
MD5

01fc20e3188ec0b39c6a26f031f77b05
SHA1

f233c1d8fd439c1d26c35ef4a7220a4c4382eac4
SHA256

2d573e392c6c5ef71a6e94f5f7965557f42adca005e3eb6723c1f14f5e4ea396
SHA512

f957adc56c46802c89d7a5010440154290f541574a170ab8bea8251b2a3333801149f133f14b44382d890b1b47ff4db98513f1fc45829fdcfdced1ca2ab89d46
SSDEEP

6144:gEc8GngikIrMbA96Vid9szw77k6M8i1cES128JV3Lk1q13+pKSSFxi8d0Q7kTUxf:i8GnykJs0MO128JtpuY9ccSI8tAZH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 3096	624	rundll32.exe	82
PID 624 wrote to memory of 3096	624	rundll32.exe	82
PID 624 wrote to memory of 3096	624	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\01fc20e3188ec0b39c6a26f031f77b05_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:624
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\01fc20e3188ec0b39c6a26f031f77b05_JaffaCakes118.dll,#1
  2⤵
  PID:3096

memory/3096-0-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download