64b005993828899f531df5efbcd528510a94805429e9f5a2422d96094c399a2e

Analysis

max time kernel
140s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 13:47

Target

0e4c85c18a64f77ba84f5a82225c43ab_JaffaCakes118.dll
Size

120KB
MD5

0e4c85c18a64f77ba84f5a82225c43ab
SHA1

44a84aef867fca2b705c1c013ab488701bcd763c
SHA256

64b005993828899f531df5efbcd528510a94805429e9f5a2422d96094c399a2e
SHA512

cbacca0c779747178a0e2a81ab12310be37efdf926430db688ef5a33f1b425ea55d276cfbacdd98bdd6b75a6048e419ab84e2381f26c3af9da0a7b7c120dc439
SSDEEP

3072:3KkSGZvlK3BpeIFciV3jU4nEvlTaPxpg0Vi8KGLYoLN:3KkSANIKIFc0N4kEc1nJ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 220	4996	rundll32.exe	83
PID 4996 wrote to memory of 220	4996	rundll32.exe	83
PID 4996 wrote to memory of 220	4996	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e4c85c18a64f77ba84f5a82225c43ab_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e4c85c18a64f77ba84f5a82225c43ab_JaffaCakes118.dll,#1
  2⤵
  PID:220

memory/220-0-0x000000006D3D0000-0x000000006D3F3000-memory.dmp

Filesize
140KB

Download