66a89392f468fbff8f84674321a5e5cf779a202180bf4135ea9495541a288eda

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25-06-2024 15:02

Target

0e811f2281cf586d493586599f2c0a14_JaffaCakes118.dll
Size

248KB
MD5

0e811f2281cf586d493586599f2c0a14
SHA1

e6c3aae1bcd330d46e0c59238f9ff32a4edd32c7
SHA256

66a89392f468fbff8f84674321a5e5cf779a202180bf4135ea9495541a288eda
SHA512

9ecc5d8fa0ebe85b88a12b16a21bc19fb8faffa517fb90aae3bc833d705828fa3422cd8ca6931f4df8b23bf47573d65a3d75ea10f2feef64dce90db8d25fba30
SSDEEP

6144:SdsYs0YJ0bHT4ywe8Y0HP7caK9XjZGPzrti2jmEwI13o8GWY56xkZe:PYsRJPVexGDK9XjZMzJi2iE7S8G5KkZe

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3488 wrote to memory of 1500	3488	rundll32.exe	80
PID 3488 wrote to memory of 1500	3488	rundll32.exe	80
PID 3488 wrote to memory of 1500	3488	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e811f2281cf586d493586599f2c0a14_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3488
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e811f2281cf586d493586599f2c0a14_JaffaCakes118.dll,#1
  2⤵
  PID:1500

memory/1500-0-0x000000006F8C0000-0x000000006F900000-memory.dmp

Filesize
256KB

Download