168213e03b87d1509e4e2269a890b11dcc32a8a6a85491a49778e00eb7c2642b

Analysis

max time kernel
136s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 22:49

Target

0fd101d3ac9ad4f3d8bce36e31a57208_JaffaCakes118.dll
Size

47KB
MD5

0fd101d3ac9ad4f3d8bce36e31a57208
SHA1

d00462f3f61fbcb09f04249c82ba1b60844dafbd
SHA256

168213e03b87d1509e4e2269a890b11dcc32a8a6a85491a49778e00eb7c2642b
SHA512

552f19ec3c0cebe917e40c7fef5c508b93cb812dc139c3e5af684ae8834a2ae7a49c6583544103212b8823b9d0fe8691d50b18bb334494a2ef039de7c41bb1cc
SSDEEP

768:r0KOVu7l/DN9sHS11EE7dIxI0kcjGkssOhN2TJ/IYoEtkNkauPEJ:T/DLsHS11EbH5bOhN+/IYoEu6pEJ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 4940	2708	rundll32.exe	83
PID 2708 wrote to memory of 4940	2708	rundll32.exe	83
PID 2708 wrote to memory of 4940	2708	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0fd101d3ac9ad4f3d8bce36e31a57208_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0fd101d3ac9ad4f3d8bce36e31a57208_JaffaCakes118.dll,#1
  2⤵
  PID:4940

memory/4940-0-0x00000000010D0000-0x00000000010D8000-memory.dmp

Filesize
32KB

Download