27130a41d3e9cdfada35b1356f30bdc83b0204aecab12103d0749beb7fc3b80b

Analysis

max time kernel
141s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 18:14

Target

0a10b324f8da4a1abca662365f9d2e31_JaffaCakes118.dll
Size

505KB
MD5

0a10b324f8da4a1abca662365f9d2e31
SHA1

714b0c13652d11ef0d1826c3b01dccd34256da2e
SHA256

27130a41d3e9cdfada35b1356f30bdc83b0204aecab12103d0749beb7fc3b80b
SHA512

c22c7f1961b5fa05d0f2442fadd77104f9b471df922fc8d786aaf07a42cfee233da6aba14e6a8f4a36a6b90bd795eb040b78bc144072c39b1eb1b537f574d827
SSDEEP

12288:G9IfTWoSk8d1ABmEmjnli9AvnMpbuJtKX5e:GifnSkaAB9wLAyTKpe

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3912 wrote to memory of 4884	3912	rundll32.exe	83
PID 3912 wrote to memory of 4884	3912	rundll32.exe	83
PID 3912 wrote to memory of 4884	3912	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0a10b324f8da4a1abca662365f9d2e31_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3912
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0a10b324f8da4a1abca662365f9d2e31_JaffaCakes118.dll,#1
  2⤵
  PID:4884

memory/4884-0-0x000000004DE20000-0x000000004DE9F000-memory.dmp

Filesize
508KB

Download