1e1d22394a9870f7f5aaef9944e2462239ed13eeb2e044048c3ea6fb45022a1f

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
07/07/2024, 23:30

Target

2a2cec4d16060bf706a8cad864b57846_JaffaCakes118.dll
Size

96KB
MD5

2a2cec4d16060bf706a8cad864b57846
SHA1

f0a96340f16eecba8e13b4946ca1d113cf7a0c1d
SHA256

1e1d22394a9870f7f5aaef9944e2462239ed13eeb2e044048c3ea6fb45022a1f
SHA512

217ae1d7d34db5c5c46f5543bc15755be4bab39e69f7a3347ac5032febe65a84b2dc99965b90b4fb44ae5f683d829ed4666e1edc5b25d9765a18dff39b26622b
SSDEEP

1536:eJglIskGc9oSFwhw7hPXT1Z4YHHnlrt4rtG9AV0LO:cIIgYHn7hPj1+YYwX6

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4756 wrote to memory of 3332	4756	rundll32.exe	82
PID 4756 wrote to memory of 3332	4756	rundll32.exe	82
PID 4756 wrote to memory of 3332	4756	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a2cec4d16060bf706a8cad864b57846_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a2cec4d16060bf706a8cad864b57846_JaffaCakes118.dll,#1
  2⤵
  PID:3332

memory/3332-0-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download