d03467d0dbb25ad5b7ee6c961168e535f50d8291ba7548f0716c4d0bd1d44819

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 15:55

Target

077e4aa96a2f04f860f680a430290eaf_JaffaCakes118.dll
Size

137KB
MD5

077e4aa96a2f04f860f680a430290eaf
SHA1

75ee5178f70f60fe22217b7199da61f6e2ae8c0a
SHA256

d03467d0dbb25ad5b7ee6c961168e535f50d8291ba7548f0716c4d0bd1d44819
SHA512

06c9986f9dd182358fe0c7583531dc861a0672247d4cfe8b45f8121c547569faa1e65a915909d34488a3ee4173ea01530b65145e3f793537b7c526c8d6ae3463
SSDEEP

1536:dUDt2chfuKEDx7l5CS5Mk/e1w74xXvpe3MV76RtNcBTc7QCsE8P2BsN5G3a5JSr3:dovtAgzeZVMCsE8U6Svd7b3a5mOdIZv

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 4040	2748	rundll32.exe	82
PID 2748 wrote to memory of 4040	2748	rundll32.exe	82
PID 2748 wrote to memory of 4040	2748	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\077e4aa96a2f04f860f680a430290eaf_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\077e4aa96a2f04f860f680a430290eaf_JaffaCakes118.dll,#1
  2⤵
  PID:4040

memory/4040-0-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download