3974c84c81db45f2633bfe388d441659262949224feb54c589cb549275ea6b9c

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 14:29

Target

090fbec8856efa2cb901291dfddfeed0_JaffaCakes118.dll
Size

52KB
MD5

090fbec8856efa2cb901291dfddfeed0
SHA1

ceda4f352ba7b5ed1124262b77dba0ae7c33ecb6
SHA256

3974c84c81db45f2633bfe388d441659262949224feb54c589cb549275ea6b9c
SHA512

5476eca456bbd85426d5ee5fb95c1166b0d20169d63371432ef4a68ec6e3ee3b2b38e32db84bec84e0445bd22a55b0b7c3746a4b02e45d2053a7daf6381c4ad4
SSDEEP

768:g2v8ZgicpxqBJsXXGJz83AkTAjoCGygLCXo9OvHjRG:WZgi3Bk2J837TAjoC5c+oyG

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 924	1916	rundll32.exe	83
PID 1916 wrote to memory of 924	1916	rundll32.exe	83
PID 1916 wrote to memory of 924	1916	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\090fbec8856efa2cb901291dfddfeed0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\090fbec8856efa2cb901291dfddfeed0_JaffaCakes118.dll,#1
  2⤵
  PID:924

memory/924-0-0x0000000002C50000-0x0000000002D26000-memory.dmp

Filesize
856KB

Download