e134c153da6a15008cc7754b5eb17a8e3177103a24a13c183fcd48c1950b9c7c

Analysis

max time kernel
94s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11-07-2024 16:29

Target

39e54d3718c4a50d5cc3a6defc8a4b60_JaffaCakes118.dll
Size

65KB
MD5

39e54d3718c4a50d5cc3a6defc8a4b60
SHA1

7df859ea8d4dc735a2c97352d665636cf8d8a831
SHA256

e134c153da6a15008cc7754b5eb17a8e3177103a24a13c183fcd48c1950b9c7c
SHA512

6e8eee1c2ea6bc46497491b1da4d5f7506115c153b68d4d4592fac427b275b448bd0d4c2a91f3776f3c7437d18b7b970fc3066e9eb6a2c48a265c263f88a030c
SSDEEP

1536:TTHe9FMUda1AmBRguM10CHQ959h3h0PiLG14LVxZtG8au9l8:nHuK1TBquMjHg9EPiLG1QjtGPu9l8

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 2748	4128	rundll32.exe	83
PID 4128 wrote to memory of 2748	4128	rundll32.exe	83
PID 4128 wrote to memory of 2748	4128	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\39e54d3718c4a50d5cc3a6defc8a4b60_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\39e54d3718c4a50d5cc3a6defc8a4b60_JaffaCakes118.dll,#1
  2⤵
  PID:2748

memory/2748-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download