cb2fd0f8ff6b1cb02b9508de6ab55aae4ca09a8a5c772ff5add2f4ef063d76fe

Analysis

max time kernel
93s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 23:21

Target

326748a02a069afbd1456df9a772b6d0_JaffaCakes118.dll
Size

1.1MB
MD5

326748a02a069afbd1456df9a772b6d0
SHA1

284d3fd4b286331335f58ff321a53f554922c94e
SHA256

cb2fd0f8ff6b1cb02b9508de6ab55aae4ca09a8a5c772ff5add2f4ef063d76fe
SHA512

52b40f8734d90ee66927688d6a1cca567bdf355998c37c2319072c9f9f7360e417875e3d83f712164fe19b85bc6ea5e64916f50096f70d583a47faf9f2fe7f68
SSDEEP

12288:graWXzXtBd47xbFL0rYGWAvuViTZiTi0sH4:RBFQrcAvuVitCOY

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 1352	4556	rundll32.exe	81
PID 4556 wrote to memory of 1352	4556	rundll32.exe	81
PID 4556 wrote to memory of 1352	4556	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\326748a02a069afbd1456df9a772b6d0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\326748a02a069afbd1456df9a772b6d0_JaffaCakes118.dll,#1
  2⤵
  PID:1352

memory/1352-0-0x000000007C800000-0x000000007C91F000-memory.dmp

Filesize
1.1MB

Download