9a7985de3e12b583097d1606e50e91adc8a057fb24c3a6ed5395bb0fecc970a1

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 11:17

Target

38e3cb8eaf6eeaf85d3877bc0a2cbfc8_JaffaCakes118.dll
Size

6KB
MD5

38e3cb8eaf6eeaf85d3877bc0a2cbfc8
SHA1

2919147d3b69ddb69eb9186d084e0bd635245966
SHA256

9a7985de3e12b583097d1606e50e91adc8a057fb24c3a6ed5395bb0fecc970a1
SHA512

c62c3e223afcd4dacf4e8a48587eb99d2444beea8120a4b6aaef30e5491505373e181f95cb82c0337e7ac3c0061ed86e6334110713f2e96773a50230b8dabff0
SSDEEP

48:aGy7MN4cpSGAXbIni1kvNs6ztutiKIZWiwQTnU5WwG2QozbC:xB4c4G6bn1k1sw0EW3enIWwGqb

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3864 wrote to memory of 1480	3864	rundll32.exe	83
PID 3864 wrote to memory of 1480	3864	rundll32.exe	83
PID 3864 wrote to memory of 1480	3864	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\38e3cb8eaf6eeaf85d3877bc0a2cbfc8_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3864
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\38e3cb8eaf6eeaf85d3877bc0a2cbfc8_JaffaCakes118.dll,#1
  2⤵
  PID:1480

memory/1480-0-0x00000000011B0000-0x00000000011B6000-memory.dmp

Filesize
24KB

Download