a7fcc871edf988ef84b8db2b9887e65afb06bb2617d67713f354cf81126482ec

Analysis

max time kernel
139s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 14:44

Target

0e764a38c09a1cef4531b53b6982b7b7_JaffaCakes118.dll
Size

35KB
MD5

0e764a38c09a1cef4531b53b6982b7b7
SHA1

f33e6281a23fa5f8b091be84ff95de4ba643931e
SHA256

a7fcc871edf988ef84b8db2b9887e65afb06bb2617d67713f354cf81126482ec
SHA512

7a9cca92cbe718be2ecb273273f1c705bfdaf49b11bd110504054fff1934dc85238010559a5fbfd965ac74512f0a5efed4ee2d87f9238de4843862e63f92dc2e
SSDEEP

768:94ZTvvQhRjbacva8F8SWfnGfS6XFXeXeXeXeXQX4XIE2XIEFXIr:9YLQ/PachG/G69EXEKr

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 3280	4372	rundll32.exe	83
PID 4372 wrote to memory of 3280	4372	rundll32.exe	83
PID 4372 wrote to memory of 3280	4372	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e764a38c09a1cef4531b53b6982b7b7_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e764a38c09a1cef4531b53b6982b7b7_JaffaCakes118.dll,#1
  2⤵
  PID:3280

memory/3280-0-0x0000000010000000-0x0000000010003000-memory.dmp

Filesize
12KB

Download