0a327664b65e8309524efd45aa7f3e9b740dd64ff5513ac4a96e63d39ea4ba96

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 14:10

Target

1a6c17639838ce3eeef212150a9a6116_JaffaCakes118.dll
Size

81KB
MD5

1a6c17639838ce3eeef212150a9a6116
SHA1

780647bfaa3d9df9a1de5ed2d49065373a521356
SHA256

0a327664b65e8309524efd45aa7f3e9b740dd64ff5513ac4a96e63d39ea4ba96
SHA512

9c834ccb9273217b96d1b1f1fbee550609d11c61392fa414fdf4b09330c399cc9aa73dd89c2af2dc417928231037433772e537f901a532bc64c40bb2eca73166
SSDEEP

768:7P944a767tbkH2YUPKOYai3eZRI0g3DR5UO6Ed:TVa6bkW3PsH3eQzR5UO6

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 1752	1416	rundll32.exe	81
PID 1416 wrote to memory of 1752	1416	rundll32.exe	81
PID 1416 wrote to memory of 1752	1416	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a6c17639838ce3eeef212150a9a6116_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a6c17639838ce3eeef212150a9a6116_JaffaCakes118.dll,#1
  2⤵
  PID:1752

memory/1752-0-0x0000000075560000-0x0000000075588000-memory.dmp

Filesize
160KB

Download