c6b1ce35b55a2b65da0f56f4ae3899ff5654e84efc093c9958b04fe1e06e4baa

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240708-en
resource tags

arch:x64arch:x86image:win10v2004-20240708-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 17:04

Target

2d226895bf5a16212966fab83bf37f99_JaffaCakes118.dll
Size

134KB
MD5

2d226895bf5a16212966fab83bf37f99
SHA1

d606fc10cc2d9371c2d4a7d2884951f3a7385428
SHA256

c6b1ce35b55a2b65da0f56f4ae3899ff5654e84efc093c9958b04fe1e06e4baa
SHA512

0fb05573dddc043ef7226148643896e2586efdd4ef7caddb7d497106e26f1289c8def99251e38ee21015410fc38c45f8076ba8beeb74c3762f81850f7aa6e7a4
SSDEEP

3072:QRARXCGjqgROQ0KHedxaS/5d7VU40ruRjrlhLkvN/2ir2w:QRARXqFIHedxaQ5d7L4uR3YvN

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4392 wrote to memory of 2876	4392	rundll32.exe	80
PID 4392 wrote to memory of 2876	4392	rundll32.exe	80
PID 4392 wrote to memory of 2876	4392	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d226895bf5a16212966fab83bf37f99_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d226895bf5a16212966fab83bf37f99_JaffaCakes118.dll,#1
  2⤵
  PID:2876

memory/2876-0-0x0000000000010000-0x0000000000032000-memory.dmp

Filesize
136KB

Download