f45bf66960404cafb828eae1ad8575b5005f5822a45eb22e85defcc51d51605b

Analysis

max time kernel
93s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27-06-2024 08:14

Target

15490e6313aa151c7e0a90cb8e6c5d22_JaffaCakes118.dll
Size

34KB
MD5

15490e6313aa151c7e0a90cb8e6c5d22
SHA1

e60a3f3e6176944dbe3520280714de033f88e8a7
SHA256

f45bf66960404cafb828eae1ad8575b5005f5822a45eb22e85defcc51d51605b
SHA512

d3ed306cf5a2d48dff18228178b141f6db93c438fc612384a9b4a7d6a47cff5dab16825d40a73c45d5a43ac034bf62e9165273e20fdd12c4680027f01d3e5458
SSDEEP

768:MTNLuiHkdJgT4XREpE0g7t0LT2MWyvjROzqfaBPi:4LuiHkzPKpc9zyFEq+K

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 216 wrote to memory of 5044	216	rundll32.exe	80
PID 216 wrote to memory of 5044	216	rundll32.exe	80
PID 216 wrote to memory of 5044	216	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\15490e6313aa151c7e0a90cb8e6c5d22_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:216
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\15490e6313aa151c7e0a90cb8e6c5d22_JaffaCakes118.dll,#1
  2⤵
  PID:5044

memory/5044-0-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download