2e16c45a817f4e762b629fff81d3ef74fb7a997de2169d445a4da38a3915843d

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 17:45

Target

09eda3f87187b7aad2f924e98321f47d_JaffaCakes118.dll
Size

10KB
MD5

09eda3f87187b7aad2f924e98321f47d
SHA1

0e7845301d584c2feddf4bb2290574af7475d1a9
SHA256

2e16c45a817f4e762b629fff81d3ef74fb7a997de2169d445a4da38a3915843d
SHA512

c2e8ae85e02d76e14440412036b1b7a8ceee59d52c1a16329834be68a6b1f3d3c5a88bee1570c616f8c7f90e72c8c57de20aa98a45b254daa31c058a60f33dcb
SSDEEP

192:41mjfw8dHabRDEgzHyl0NSyFWakiP84dW3qWak8Q7dW3o92b:48jhdHad/z20IyFWakC84dWaWak8cdWj

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 5052	2612	rundll32.exe	81
PID 2612 wrote to memory of 5052	2612	rundll32.exe	81
PID 2612 wrote to memory of 5052	2612	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\09eda3f87187b7aad2f924e98321f47d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\09eda3f87187b7aad2f924e98321f47d_JaffaCakes118.dll,#1
  2⤵
  PID:5052

memory/5052-0-0x000000006DD20000-0x000000006DD27000-memory.dmp

Filesize
28KB

Download