8d6da960d57c928776e6df982194884ec6eececf11b4c71cb62463025a477c8d

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11-07-2024 04:57

Target

37c7eedb01ac92f80807ba673f094d96_JaffaCakes118.dll
Size

106KB
MD5

37c7eedb01ac92f80807ba673f094d96
SHA1

975e6e18b4ac5653b36b67a129525e58c645a6a0
SHA256

8d6da960d57c928776e6df982194884ec6eececf11b4c71cb62463025a477c8d
SHA512

8b2b96693e041d8edcfe39fb24958bcf9691b921dc1b3b6782cb4a76787495035e1efdf96988319a96dcbfae5689bbe2b859927ced81b8a4cb5feb18ea7aebff
SSDEEP

1536:S+N8E5/7qGGp2dNmD+fI5yAVXBLc8fK0QukNcoI13DXo925bVn+KuwqjEwy:ME5/7qGhTi5PxLcKjJkNcbzCIVnijEN

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 4332	5048	rundll32.exe	83
PID 5048 wrote to memory of 4332	5048	rundll32.exe	83
PID 5048 wrote to memory of 4332	5048	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\37c7eedb01ac92f80807ba673f094d96_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\37c7eedb01ac92f80807ba673f094d96_JaffaCakes118.dll,#1
  2⤵
  PID:4332

memory/4332-0-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download