92273f36d9c2aef3a554fb7e546fcad18d0d6964c5ebae265b849c3b32bd733c

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 19:56

Target

0a8d5d2b65b68a098916276555e246f5_JaffaCakes118.dll
Size

142KB
MD5

0a8d5d2b65b68a098916276555e246f5
SHA1

534e4df6ef28a67ce578ccdda54db8466ef9f466
SHA256

92273f36d9c2aef3a554fb7e546fcad18d0d6964c5ebae265b849c3b32bd733c
SHA512

bfc8567d5e1492ed1601b63b0475ec14920a0d54d5fda3670f720967bc09823d030d8a194d0792cf29d968305e248fe8d80cbd1ad8c625bae05862531a9d5872
SSDEEP

3072:UlarDNpE1HnYeWo7MqqDLy/dfP9dcoCVQaB:yarDNCHYemqqDLuJjAe

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 1412	2260	rundll32.exe	82
PID 2260 wrote to memory of 1412	2260	rundll32.exe	82
PID 2260 wrote to memory of 1412	2260	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0a8d5d2b65b68a098916276555e246f5_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0a8d5d2b65b68a098916276555e246f5_JaffaCakes118.dll,#1
  2⤵
  PID:1412

memory/1412-0-0x0000000000520000-0x000000000052A000-memory.dmp

Filesize
40KB

Download
memory/1412-4-0x000000001000E000-0x0000000010027000-memory.dmp

Filesize
100KB

Download