ae2a3a18abe3fee07bfeb94d3415f7b9673266054cdf2178f73a74f22c08f175

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27-06-2024 12:38

Target

1609eec9d5b28fe7825ed29e98fb9dcd_JaffaCakes118.dll
Size

289KB
MD5

1609eec9d5b28fe7825ed29e98fb9dcd
SHA1

042c677d4d6a162fe2d8f93e6ca529ead4c50f84
SHA256

ae2a3a18abe3fee07bfeb94d3415f7b9673266054cdf2178f73a74f22c08f175
SHA512

db983f341b848645a37a6b5e567c51c3c8faf52c6a558553c8eed9289e6e59f9c32a6582557a7baf4060f730aae7824ca22764179c16800a0f2db6301f23e705
SSDEEP

6144:+yeig8B1Ufo2Nk/zOCnSGHAUNlMnP9D2oaVZFjaKi02SPPuGTBgX6:+GBafZNk/5SG/MnUFeO2SuGTI

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 4996	1876	rundll32.exe	81
PID 1876 wrote to memory of 4996	1876	rundll32.exe	81
PID 1876 wrote to memory of 4996	1876	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1609eec9d5b28fe7825ed29e98fb9dcd_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1609eec9d5b28fe7825ed29e98fb9dcd_JaffaCakes118.dll,#1
  2⤵
  PID:4996

memory/4996-0-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download