cb448fbc340a23d59c158ce7849d2e074bf30fb2fa8c1c3d2fd6e5001801b4da

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 22:03

Target

3ae2c4990ddd0783376e38e2fbfc5602_JaffaCakes118.dll
Size

18KB
MD5

3ae2c4990ddd0783376e38e2fbfc5602
SHA1

486ab61ae9bf520f00fb6ea5600fc16f4f195cac
SHA256

cb448fbc340a23d59c158ce7849d2e074bf30fb2fa8c1c3d2fd6e5001801b4da
SHA512

e06f9f85aebc78392a2997f9d1cfd4f5cfd94b9481f87db91083de8a3116790eb1aef47dfd4e98d465ba8553d18d48678184cf3d9f1b0891d9c566bb1c84126f
SSDEEP

384:FYnw36QBMRL1bHxWhOqlNhgfo0qFmpELoKTm8AS1OFpm:336/R1xGlz0nqF7Lod8gFE

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 4836	4660	rundll32.exe	83
PID 4660 wrote to memory of 4836	4660	rundll32.exe	83
PID 4660 wrote to memory of 4836	4660	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ae2c4990ddd0783376e38e2fbfc5602_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ae2c4990ddd0783376e38e2fbfc5602_JaffaCakes118.dll,#1
  2⤵
  PID:4836

memory/4836-0-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download