e362709c8905d22ae1c8603c5c2c1fb8492a8e096aa4f49b80077ed8ac31c197

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 15:05

Target

289844b24cf648a1752f0f0f5b28c223_JaffaCakes118.dll
Size

331KB
MD5

289844b24cf648a1752f0f0f5b28c223
SHA1

3bcff57e7b5f22c1e969c45e2aa751f746d7c5d9
SHA256

e362709c8905d22ae1c8603c5c2c1fb8492a8e096aa4f49b80077ed8ac31c197
SHA512

817b31d7ae82a87c6a4c64d578b4277b59b2d443fac88f7629846131be266a27ee8d6c5bffeb0e27b0ea702666141501d32b2a37d6e162ae4d1b8958f211976e
SSDEEP

6144:v5zrwbmXKpAAKIEhDAep/gEubrw4pmDh9jNfQJR/1l+7UuWNKH/jzIRkQ0dWihh2:prwbrf9EXpYrVpmt9jy1l+7xWsH/jzI3

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4944 wrote to memory of 504	4944	rundll32.exe	81
PID 4944 wrote to memory of 504	4944	rundll32.exe	81
PID 4944 wrote to memory of 504	4944	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\289844b24cf648a1752f0f0f5b28c223_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\289844b24cf648a1752f0f0f5b28c223_JaffaCakes118.dll,#1
  2⤵
  PID:504

memory/504-0-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download