9585be67f612f568d54df272194377dc59e100e75d21884e4f70d0d6f104c2b9

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 15:01

Target

09346f94a39589a20aefb5c1aa1ab386_JaffaCakes118.dll
Size

128KB
MD5

09346f94a39589a20aefb5c1aa1ab386
SHA1

98864b2ccedb55581fa9eee922375921072dafa2
SHA256

9585be67f612f568d54df272194377dc59e100e75d21884e4f70d0d6f104c2b9
SHA512

47ce616de74635dbcf39535884287c6a0c15e90cc3a9dc9e57d7f46e45f28e4c562965be034c91abf2257323fa90437d464725e5571a43496f31817204f46945
SSDEEP

3072:S+mD6rU50oY8ACFAXNcXN7mkidFzjMqqDLy/SoDbc:Aeks90N0FzQqqDLuS

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2628	1732	rundll32.exe	80
PID 1732 wrote to memory of 2628	1732	rundll32.exe	80
PID 1732 wrote to memory of 2628	1732	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\09346f94a39589a20aefb5c1aa1ab386_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\09346f94a39589a20aefb5c1aa1ab386_JaffaCakes118.dll,#1
  2⤵
  PID:2628

memory/2628-0-0x0000000000B10000-0x0000000000B1A000-memory.dmp

Filesize
40KB

Download
memory/2628-4-0x0000000010017000-0x0000000010026000-memory.dmp

Filesize
60KB

Download