cbe5cdb19bb6beb76b4e41524b4c953ddcd94cc9650ba55b74faef0c5fa182c2

Analysis

max time kernel
92s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 01:36

Target

32cec3a96481132e11ba9964b574dd3b_JaffaCakes118.dll
Size

18KB
MD5

32cec3a96481132e11ba9964b574dd3b
SHA1

7d9b740fdcd05a06ff8d8b966419ac73103f3292
SHA256

cbe5cdb19bb6beb76b4e41524b4c953ddcd94cc9650ba55b74faef0c5fa182c2
SHA512

ae4859aeeedbe377163c270b08c2ce837bc070aabd9ae68eb1d0fafb2eb619cde6f6610791a53715ce3ce718b0591470f07116071feff14c258654ff9b499de5
SSDEEP

192:YdilNt4qvtEdoFd5LfRLVgTcu8/rsjl+b7dpkd8j1AmCfME:Y43Dd5LpmTcT/g567dpkd8R8fME

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 336	1912	rundll32.exe	80
PID 1912 wrote to memory of 336	1912	rundll32.exe	80
PID 1912 wrote to memory of 336	1912	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\32cec3a96481132e11ba9964b574dd3b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\32cec3a96481132e11ba9964b574dd3b_JaffaCakes118.dll,#1
  2⤵
  PID:336

memory/336-0-0x0000000069640000-0x0000000069647000-memory.dmp

Filesize
28KB

Download