5bea8796050d2a52ae8e46934ebd822f74f8ad7c52ec89d3465add8534d66a3d

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 21:24

Target

26430e844ebf86afd354669222ecdff9_JaffaCakes118.dll
Size

13KB
MD5

26430e844ebf86afd354669222ecdff9
SHA1

a895e3a882198c9e9a463a2b228b280b5ba50113
SHA256

5bea8796050d2a52ae8e46934ebd822f74f8ad7c52ec89d3465add8534d66a3d
SHA512

03ff32c95e249b257af1fef36ea6c6b0bd29b90a4ab47fe181b2f549ff16d540d60fcebafbd9db79a48c979512b36a8c9663ee37448d38def03216731a9e2b2f
SSDEEP

384:3kFBLBk5wmE5l1f0sERXfRZftvDkTErKb4:0PdxlFpwfPpk4rKc

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3876 wrote to memory of 2928	3876	rundll32.exe	80
PID 3876 wrote to memory of 2928	3876	rundll32.exe	80
PID 3876 wrote to memory of 2928	3876	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\26430e844ebf86afd354669222ecdff9_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\26430e844ebf86afd354669222ecdff9_JaffaCakes118.dll,#1
  2⤵
  PID:2928

memory/2928-1-0x0000000000680000-0x0000000000697000-memory.dmp

Filesize
92KB

Download
memory/2928-0-0x0000000000680000-0x0000000000697000-memory.dmp

Filesize
92KB

Download