b00d3c8834034ee7e9cb53dcb8713398ff3d51b28c586ceddff275527da5ca97

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 16:44

Target

312d16a15de7a6f0b4f487a85d4f2815_JaffaCakes118.dll
Size

216KB
MD5

312d16a15de7a6f0b4f487a85d4f2815
SHA1

8c3c546e07084427660724e41f4b6c79db7dba7e
SHA256

b00d3c8834034ee7e9cb53dcb8713398ff3d51b28c586ceddff275527da5ca97
SHA512

6a34564cda14a042342d211eabab640c29aa243291055f91aa482e1ca0d6e0ad65be2f0e88608699a90bf6168e35256ed1c40fc420af6918fbbbc38374f7f841
SSDEEP

6144:xpr6s+MTa4YbyIXODkSonw7bnOaIaWjoWzYAOxjpf:xF6s+M7IjA7bnjImwYAOxjpf

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 1460	2632	rundll32.exe	80
PID 2632 wrote to memory of 1460	2632	rundll32.exe	80
PID 2632 wrote to memory of 1460	2632	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\312d16a15de7a6f0b4f487a85d4f2815_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\312d16a15de7a6f0b4f487a85d4f2815_JaffaCakes118.dll,#1
  2⤵
  PID:1460

memory/1460-0-0x0000000010000000-0x0000000010036000-memory.dmp

Filesize
216KB

Download