ab99194ab4ca5dd744fa46f05e7faf53ca1645f84eb258abaef9dd721a9b7fca

Analysis

max time kernel
150s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
09-07-2024 15:53

Target

310250ec6caac764c07ad8c4da435332_JaffaCakes118.dll
Size

10KB
MD5

310250ec6caac764c07ad8c4da435332
SHA1

b43cb65d647b87b42b7d7392efefdc9918d85aef
SHA256

ab99194ab4ca5dd744fa46f05e7faf53ca1645f84eb258abaef9dd721a9b7fca
SHA512

7df5532c4648d309b95caf426cb58c7408713b577f8f2cf2d63be43d1a6b57e724d1d0338ed3c2c1bcd2ef17b84a430f84215736ce1528a59bc84570f68547c3
SSDEEP

192:whhOCK+6tBYYjWFeObw/dYN7VSEGaCbQ8wwI8+0RcqlRkgUw9vDIKCQIkKW:qhRheYQI2deKaCbQ1wId06aeSD3CQIk/

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 4556	2892	rundll32.exe	80
PID 2892 wrote to memory of 4556	2892	rundll32.exe	80
PID 2892 wrote to memory of 4556	2892	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\310250ec6caac764c07ad8c4da435332_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\310250ec6caac764c07ad8c4da435332_JaffaCakes118.dll,#1
  2⤵
  PID:4556

memory/4556-0-0x0000000025000000-0x000000002501C000-memory.dmp

Filesize
112KB

Download