052d26117a184c549e06c9764f90784fc5919f0401b037c9e2b8ee07408138ce

Analysis

max time kernel
95s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 01:05

Target

32b6faffa070d2ed3c7ac92d16e1904f_JaffaCakes118.dll
Size

108KB
MD5

32b6faffa070d2ed3c7ac92d16e1904f
SHA1

a586346a540655c04d8a2305672e8aa7dac47259
SHA256

052d26117a184c549e06c9764f90784fc5919f0401b037c9e2b8ee07408138ce
SHA512

8a38745b498bec5b5b5c3edd2cf7144bfb5f32088d77966cf1af73404c4382a0c6d6721396b3c899b19c0240514f5331da3128623ae5bb8c470d759f1fc8c16c
SSDEEP

1536:vwIb/ISIGkuvfZ/AuwGENSedt25n2SZhT2yy4Q/1oEOAOFof6Y9nk7OFneEE:YM1lxvfGGBJ2KHOLOVaK7ud

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5060 wrote to memory of 3520	5060	rundll32.exe	81
PID 5060 wrote to memory of 3520	5060	rundll32.exe	81
PID 5060 wrote to memory of 3520	5060	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\32b6faffa070d2ed3c7ac92d16e1904f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5060
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\32b6faffa070d2ed3c7ac92d16e1904f_JaffaCakes118.dll,#1
  2⤵
  PID:3520

memory/3520-0-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download