814bc98bc29bad727b6579437731a1bcd0874085345b36f4e0fc60c061c2b2e0

Analysis

max time kernel
41s
max time network
48s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04-07-2024 00:24

Target

23ffb792a8544b366bd69d9b3b23cce2_JaffaCakes118.dll
Size

13KB
MD5

23ffb792a8544b366bd69d9b3b23cce2
SHA1

0640ca53d1660ffdaeb8069db7cb0462b39d521f
SHA256

814bc98bc29bad727b6579437731a1bcd0874085345b36f4e0fc60c061c2b2e0
SHA512

c99afd2d31546d9f465df536482482dcb65aedbe7fac3f418427a5178778aad81df3886d25a5eed58d58df2735e3daace4c7e7b4d2fcc8dfa0f05ebfe24c9864
SSDEEP

192:ywEA3ONU9nTNFW6ZhQ6vAVItG+k17dmaV30rAoGaHZoyodpMX66KALB6qdN:DaU7FW6ZhQ6vnsqYEe6VNKoTdN

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 1980	5104	rundll32.exe	80
PID 5104 wrote to memory of 1980	5104	rundll32.exe	80
PID 5104 wrote to memory of 1980	5104	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\23ffb792a8544b366bd69d9b3b23cce2_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\23ffb792a8544b366bd69d9b3b23cce2_JaffaCakes118.dll,#1
  2⤵
  PID:1980

memory/1980-0-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download