e2cea0d7532e45d4509a4ce963c62451d566a1a6df5a1f2d38b81dd1fdd64674

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 11:30

Target

348942bb05580e85754c3ef0f5547135_JaffaCakes118.dll
Size

124KB
MD5

348942bb05580e85754c3ef0f5547135
SHA1

798e19aec83d3472b12fa0ec43ab8b000db4dafa
SHA256

e2cea0d7532e45d4509a4ce963c62451d566a1a6df5a1f2d38b81dd1fdd64674
SHA512

8e3752c7bce53293f298c4c97be9701de46d4a26fad9c85d408757f7c495d4a13ac5aa6e03aac097f4336e12734ee93cc9d1a5254d6e01000fa9fc167aec3ba1
SSDEEP

1536:BA/JTjuwpcxRaMrx5PNYrKqq5CwwozhOtftHpdwbHaIxQukFlfdVjodVMo:BA/JTjuheMrFQwieb6IxXYlfdVAu

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 428 wrote to memory of 4412	428	rundll32.exe	83
PID 428 wrote to memory of 4412	428	rundll32.exe	83
PID 428 wrote to memory of 4412	428	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\348942bb05580e85754c3ef0f5547135_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:428
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\348942bb05580e85754c3ef0f5547135_JaffaCakes118.dll,#1
  2⤵
  PID:4412

memory/4412-0-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download