106db35f29f0c7dfed23e48b22ddbf806492a8d04b933a80df163a2d34db66d1

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 13:58

Target

3502d629d88e2960bc40c67792ffb0da_JaffaCakes118.dll
Size

9KB
MD5

3502d629d88e2960bc40c67792ffb0da
SHA1

b8f6f46dbec447ab4d06160bd2c73fb60394f65f
SHA256

106db35f29f0c7dfed23e48b22ddbf806492a8d04b933a80df163a2d34db66d1
SHA512

10f245ff39e8c2300b8df243ae1707acc8093d0c792527920047a31cd221d2b24a038bf03c5b021582077d04471d5b67ae70b61efc9f3d19eac77bc9473522ad
SSDEEP

96:q1V7dR7uwEU+hCT3GrxZ4MUtPNlz0MdG8EWvdM3IWwG34b:kuwEt8rsTUtPLzKNWSYWF4b

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2344	2300	rundll32.exe	83
PID 2300 wrote to memory of 2344	2300	rundll32.exe	83
PID 2300 wrote to memory of 2344	2300	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3502d629d88e2960bc40c67792ffb0da_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3502d629d88e2960bc40c67792ffb0da_JaffaCakes118.dll,#1
  2⤵
  PID:2344

memory/2344-0-0x00000000005D0000-0x00000000005D7000-memory.dmp

Filesize
28KB

Download