57693a385b7c6ef65fb1bba9bcf6a9409b93c120085dac9c6028f873311ac132

Analysis

max time kernel
139s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 07:22

Target

03fceff78ba4c7a57ee219d405c2d1a0_JaffaCakes118.dll
Size

14KB
MD5

03fceff78ba4c7a57ee219d405c2d1a0
SHA1

09f492da7dd002a8d754849d8212b462537de836
SHA256

57693a385b7c6ef65fb1bba9bcf6a9409b93c120085dac9c6028f873311ac132
SHA512

0e9538998b4d15de03df00cc3dd9637ac9f5456633396ea7dedc6aa0d03eadc45b06b11b4368e12cdb14cc7ceb0f92f70c705f0ae58d5a308629158eebd208fd
SSDEEP

192:BQuhaqSzfSMreYIxz7rL3fLuBXYTnH8IzOhVV9Uu4XrNoXGLScblZEPmlY+kihyR:BGTIdnuBoDCeX+WG+rlY+yNe1Wr

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 2240	5072	rundll32.exe	82
PID 5072 wrote to memory of 2240	5072	rundll32.exe	82
PID 5072 wrote to memory of 2240	5072	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\03fceff78ba4c7a57ee219d405c2d1a0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\03fceff78ba4c7a57ee219d405c2d1a0_JaffaCakes118.dll,#1
  2⤵
  PID:2240

memory/2240-0-0x0000000001390000-0x000000000139C000-memory.dmp

Filesize
48KB

Download