aac18378e0ce2633a3e5a48de81935a081288f978ecd08f7d819f271e4d1781d

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 13:37

Target

1b7fc5f736ceebb79fc21cd4f0dad6a8_JaffaCakes118.dll
Size

33KB
MD5

1b7fc5f736ceebb79fc21cd4f0dad6a8
SHA1

a58560438af5b6919afb7969236d3a8e0ff94c4c
SHA256

aac18378e0ce2633a3e5a48de81935a081288f978ecd08f7d819f271e4d1781d
SHA512

5a3267dfe947aa08829264ad5f90521d0d318f8f782f5eafe7e95867ac0958876bf312f1fea4b588c21608ac09943a136b2831c9c7c583a46cb9d55e5033fd81
SSDEEP

768:AZoTN5RiKf/ADYMKiCzVlskgja+GrhrkUI3tBlR:Uo55RiktRlVIa+Gr6UI3tzR

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4780 wrote to memory of 4768	4780	rundll32.exe	81
PID 4780 wrote to memory of 4768	4780	rundll32.exe	81
PID 4780 wrote to memory of 4768	4780	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1b7fc5f736ceebb79fc21cd4f0dad6a8_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1b7fc5f736ceebb79fc21cd4f0dad6a8_JaffaCakes118.dll,#1
  2⤵
  PID:4768

memory/4768-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download