9d4f5576e8159130d6b91f3a2856f7039031d375b0191f3b79c73347292570a5

Analysis

max time kernel
135s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 06:23

Target

0d02bb49f6e65621d1b7f5bf56b87cf6_JaffaCakes118.dll
Size

44KB
MD5

0d02bb49f6e65621d1b7f5bf56b87cf6
SHA1

738b97cf4395be76df2c90cd45d16113f34c9478
SHA256

9d4f5576e8159130d6b91f3a2856f7039031d375b0191f3b79c73347292570a5
SHA512

13bae5bbff027c3f4e194c58578ceb76250df73a3d3bd7a75052177e57f3c6db84e48f50350303a8e753f3a2184b51abf21d0324acdb3ec47e875817a519d554
SSDEEP

192:JqB/mvycQF3NYeMyI83BdL7V8kSAzzBqNnSq9eLKQFikqqVK2KgjUhVHgtXtcv3y:0omDq8PVJzWnS4eLpWvxwUbHBPt6jPS

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 2528	2724	rundll32.exe	82
PID 2724 wrote to memory of 2528	2724	rundll32.exe	82
PID 2724 wrote to memory of 2528	2724	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d02bb49f6e65621d1b7f5bf56b87cf6_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d02bb49f6e65621d1b7f5bf56b87cf6_JaffaCakes118.dll,#1
  2⤵
  PID:2528

memory/2528-0-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download