82ad74afaaeebabc4b6c88a17a929bfdf4b6617f62f53507eefd759d244f86f7

Analysis

max time kernel
93s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10-07-2024 00:43

Target

32a66a8e747496990978288710ef3dcb_JaffaCakes118.dll
Size

20KB
MD5

32a66a8e747496990978288710ef3dcb
SHA1

dd723c75ba3781782bf9ee96f883f2fe03029fa1
SHA256

82ad74afaaeebabc4b6c88a17a929bfdf4b6617f62f53507eefd759d244f86f7
SHA512

d1c841e47904594c5c0a3e2abff3ed91dcb96d9cdae7f95f21fa43c68e2abba43ac2f4caba23e91b48fe708453f87f625aa4b7ebc29184acb7ddb7511c17135f
SSDEEP

384:ateOXv5cbDyXfQ5LpxjQOUONleots86cdpkd8R8fM7:yc6XfIHIodp6IP7

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 1976	2772	rundll32.exe	82
PID 2772 wrote to memory of 1976	2772	rundll32.exe	82
PID 2772 wrote to memory of 1976	2772	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\32a66a8e747496990978288710ef3dcb_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\32a66a8e747496990978288710ef3dcb_JaffaCakes118.dll,#1
  2⤵
  PID:1976

memory/1976-0-0x0000000062700000-0x0000000062708000-memory.dmp

Filesize
32KB

Download