be7e3d73857a8c5aaef4e36250585e0af6591c54e72f82764863437038ebcec1

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 16:23

Target

07b38b06251a9b975ff9d5cd63620f8a_JaffaCakes118.dll
Size

9KB
MD5

07b38b06251a9b975ff9d5cd63620f8a
SHA1

7c50db677910d32e474d8164d6087b270de6a3de
SHA256

be7e3d73857a8c5aaef4e36250585e0af6591c54e72f82764863437038ebcec1
SHA512

34165279e19171804a0f0db8093e37d7b6bfa4bc02950a17318a4950d4fd33a2b7b626ffb9fb1e25c53001b57839723b19b7ab98fe1b0f05f9096152dc548caf
SSDEEP

192:vD+hGQEz19+3F/GGOAPJWnw3AnA7Sn2InEbs6JpOONV0kgUw9G:r+hG6ZKFWf7Sn2Inh6DOO7d

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 3956	4624	rundll32.exe	82
PID 4624 wrote to memory of 3956	4624	rundll32.exe	82
PID 4624 wrote to memory of 3956	4624	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\07b38b06251a9b975ff9d5cd63620f8a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\07b38b06251a9b975ff9d5cd63620f8a_JaffaCakes118.dll,#1
  2⤵
  PID:3956

memory/3956-0-0x0000000025000000-0x000000002501A000-memory.dmp

Filesize
104KB

Download