03bd693695ad6a8776333c7f1d62f66a841b6eaf86f32970d07afca0e9b5910a

Analysis

max time kernel
94s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11-07-2024 12:48

Target

392d77fa0627db36566ff86dcc1032ed_JaffaCakes118.dll
Size

10KB
MD5

392d77fa0627db36566ff86dcc1032ed
SHA1

c30d1fea54993ee5d675dabeab4df5d90759605f
SHA256

03bd693695ad6a8776333c7f1d62f66a841b6eaf86f32970d07afca0e9b5910a
SHA512

8f56edb812cdadc96186e5cc5b0eb7a694146e377ff61a51796970d605ea04b0daf1245559b7c9f70182d8045dae095e36cc31f3b62fb1dacc03e520e045a1eb
SSDEEP

192:j6ugjOSp/QtxDJYqkoo7FVQ43tqpO/VGsrY1Y12MBLMQdjgNpNk2Ski1x:8KSp/QtxDWq6RVhtJgmY1i2MBL6

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4156 wrote to memory of 1140	4156	rundll32.exe	83
PID 4156 wrote to memory of 1140	4156	rundll32.exe	83
PID 4156 wrote to memory of 1140	4156	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\392d77fa0627db36566ff86dcc1032ed_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4156
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\392d77fa0627db36566ff86dcc1032ed_JaffaCakes118.dll,#1
  2⤵
  PID:1140

memory/1140-0-0x0000000010000000-0x0000000010005000-memory.dmp

Filesize
20KB

Download