c2cc0de2c8529046dc58bd586e5675fa562d098956b2d0369695febd795690fb

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09-07-2024 02:27

Target

2eae3e847e7def896c3005e9dae7731e_JaffaCakes118.dll
Size

14KB
MD5

2eae3e847e7def896c3005e9dae7731e
SHA1

18511d5bf3d1a4ada82c1f4defadfe0573f29df9
SHA256

c2cc0de2c8529046dc58bd586e5675fa562d098956b2d0369695febd795690fb
SHA512

06d04ed2a5c18ae577961f1aec94cd2018cb6663fd6adbff2ac2336e7453473325ff4b96a4ec762c563a608a5c33e7c052a18936c4f2e0e39a53924bbd79bb9e
SSDEEP

192:qspqtJmjMScU41+HMgL8eem0PVafq2otoe014qWRUDnA7ciyw:ytJmQScb1wMg8E0PcfqzmF14PGDnR

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 5364	2036	rundll32.exe	82
PID 2036 wrote to memory of 5364	2036	rundll32.exe	82
PID 2036 wrote to memory of 5364	2036	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2eae3e847e7def896c3005e9dae7731e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2eae3e847e7def896c3005e9dae7731e_JaffaCakes118.dll,#1
  2⤵
  PID:5364

memory/5364-0-0x0000000005CE0000-0x0000000005CEC000-memory.dmp

Filesize
48KB

Download