514252b832315da70f4f5b441e3e51901bbea44a68247984fd73e9ec9aac25e7

Analysis

max time kernel
93s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 14:27

Target

3982556388c33b864488dad398bd7a6b_JaffaCakes118.dll
Size

2.0MB
MD5

3982556388c33b864488dad398bd7a6b
SHA1

cde83c2774966a809750059faebb1e3fba81bb76
SHA256

514252b832315da70f4f5b441e3e51901bbea44a68247984fd73e9ec9aac25e7
SHA512

8a189db92fdf780de1db15ef7819fb82a6c8dba9bf4716d6980ec0903acd56ff46655fcbd43c1b5d489eda673324a1bcfc4868f8fd71c7dfeba986e4bed73ab3
SSDEEP

49152:oILLEZVk6y3tQu2XG8ZoI9Z9rqyI44HppuzGT:qZ26y3SWGoqZ92yVG/uzGT

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 4764	2384	rundll32.exe	83
PID 2384 wrote to memory of 4764	2384	rundll32.exe	83
PID 2384 wrote to memory of 4764	2384	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3982556388c33b864488dad398bd7a6b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3982556388c33b864488dad398bd7a6b_JaffaCakes118.dll,#1
  2⤵
  PID:4764

memory/4764-0-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download