2f23b558adb3d1ad3afebd038719b4c27f14884ff1c527a7e2778dae35f82240

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 01:26

Target

2742d17633045916bc90126f83c3cc9c_JaffaCakes118.dll
Size

70KB
MD5

2742d17633045916bc90126f83c3cc9c
SHA1

c6ec0821f5c240eacaaf005bf2b39900e38b1875
SHA256

2f23b558adb3d1ad3afebd038719b4c27f14884ff1c527a7e2778dae35f82240
SHA512

f699a85a8f5655f23dea1501589caf7dbd5f26aca1f7902edb419ac814fadd985b5c7877b216be401dbbd8f1fa5e6978768246d8470dbbd52bcc48fcbbc03441
SSDEEP

1536:VrjGvPTDHP5dt304SU5xheafmQVs5hG2KIL9J:JjGvrVf04S8heCmQV+R

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4440 wrote to memory of 1496	4440	rundll32.exe	82
PID 4440 wrote to memory of 1496	4440	rundll32.exe	82
PID 4440 wrote to memory of 1496	4440	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2742d17633045916bc90126f83c3cc9c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4440
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2742d17633045916bc90126f83c3cc9c_JaffaCakes118.dll,#1
  2⤵
  PID:1496

memory/1496-0-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download