3c6e43420568bf05563b838d3949716765c4a634e5224f7af578566f9fd57922

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 09:57

Target

2fea58128a893b1a5119f30ab648de86_JaffaCakes118.dll
Size

22KB
MD5

2fea58128a893b1a5119f30ab648de86
SHA1

e2172309f228d6af58eac3c5f26404f82afc7899
SHA256

3c6e43420568bf05563b838d3949716765c4a634e5224f7af578566f9fd57922
SHA512

46ad2c599af22ec940765cd6efa28f210b83751253264f8ddc32d1dfec1c40eb30964bc339896ecd13aa986b082036c041e97fbadd2afd4a29589aaed3cf226c
SSDEEP

384:LWWTEcWlypHksHzgHIhL9x7kHpBqZlb+W+poqbHj/ZWD/9qLKP3j+JSd6oGswCn:kuHksEHnBElbt7GHD4z9q2Ld4s9

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 3608	1548	rundll32.exe	82
PID 1548 wrote to memory of 3608	1548	rundll32.exe	82
PID 1548 wrote to memory of 3608	1548	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2fea58128a893b1a5119f30ab648de86_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2fea58128a893b1a5119f30ab648de86_JaffaCakes118.dll,#1
  2⤵
  PID:3608

memory/3608-0-0x0000000002010000-0x0000000002034000-memory.dmp

Filesize
144KB

Download