3a8ce6192c38f8b181a436f54c15f96237e9e1cf4ff3ee908c154bc8839c82b5

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 02:47

Target

022a13821f87c8eb16dca7544a343300_JaffaCakes118.dll
Size

25KB
MD5

022a13821f87c8eb16dca7544a343300
SHA1

00d7a7d93ba0f41206f665eee38ed687a887e337
SHA256

3a8ce6192c38f8b181a436f54c15f96237e9e1cf4ff3ee908c154bc8839c82b5
SHA512

14901712dee59c55681d88cc9e7db9de49a04195cd09b0fa3664d6b99cbf9aa04cfe1f820251b16cbe5fc3fcc766e611b02c1ee355312ce74cd51faa4f46713e
SSDEEP

384:DaUxz0C+Mgqd+1pqBQe+VItZFfVwid1LEXQ5b9I4zpSltsHjAzDNP:2RC+lqdSwBQhWDzwid1LZ3Ebfp

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3648 wrote to memory of 3932	3648	rundll32.exe	83
PID 3648 wrote to memory of 3932	3648	rundll32.exe	83
PID 3648 wrote to memory of 3932	3648	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\022a13821f87c8eb16dca7544a343300_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3648
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\022a13821f87c8eb16dca7544a343300_JaffaCakes118.dll,#1
  2⤵
  PID:3932

memory/3932-0-0x00000000005F0000-0x00000000005FC000-memory.dmp

Filesize
48KB

Download