7e5ea14c33fb7fc5803bd8d46d3f3548534dd4ea691e498e58030c51614eee3d

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 11:36

Target

15db98ea3890eb11962eb20c8d194df9_JaffaCakes118.dll
Size

48KB
MD5

15db98ea3890eb11962eb20c8d194df9
SHA1

f81d0b53bc045bbdd97239da7795c3e9fc511e51
SHA256

7e5ea14c33fb7fc5803bd8d46d3f3548534dd4ea691e498e58030c51614eee3d
SHA512

52f025a0375f232ecb12e341d8f9a9ca24970d8f3c98bb9c58821ffe7fdd4b7d48fb2aadb044c3b2cac58e58183b8f9d843d9002ad67bb6b12893370b721008e
SSDEEP

384:hXwpV4MzaesJr5SHASrw1hVfmLhPVCE2jrWSj+vxFU5qMJ6E1c6/vPXk9:hXwjrV48JrcL+LhPVCnuDLUNlPXk9

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2588 wrote to memory of 4464	2588	rundll32.exe	80
PID 2588 wrote to memory of 4464	2588	rundll32.exe	80
PID 2588 wrote to memory of 4464	2588	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\15db98ea3890eb11962eb20c8d194df9_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\15db98ea3890eb11962eb20c8d194df9_JaffaCakes118.dll,#1
  2⤵
  PID:4464

memory/4464-0-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download