d64e041eecd5700e9137eab8f0510d39c3b2a00579c3d89818a6e6eb2ec10904

Analysis

max time kernel
95s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 12:49

Target

392e488139ad6430ee558e592454f346_JaffaCakes118.dll
Size

58KB
MD5

392e488139ad6430ee558e592454f346
SHA1

f29f0720d90a79668dfdb9333dc1068e54d595a7
SHA256

d64e041eecd5700e9137eab8f0510d39c3b2a00579c3d89818a6e6eb2ec10904
SHA512

15f000bfd0be05defa9ce263021686cad79e552684af3207cae2a50398687760c6c925115a72be7b8e13feb0f36633b6fae428d24248ee64d555395ce3a14dcb
SSDEEP

768:LEUs6lKOxyKfjkAG5Xqijth6UQIP9vqhVVxr+ptVqDkR1dxXGI0v:LPEOxyjP3jthL9CgnQ2XxX3S

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 3012	2908	rundll32.exe	85
PID 2908 wrote to memory of 3012	2908	rundll32.exe	85
PID 2908 wrote to memory of 3012	2908	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\392e488139ad6430ee558e592454f346_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\392e488139ad6430ee558e592454f346_JaffaCakes118.dll,#1
  2⤵
  PID:3012

memory/3012-0-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download