f212c0f4a2b779de34359c03e293503534c8c849257ac96c9ff17af67b3c4407

Analysis

max time kernel
142s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 03:48

Target

3be23c3d15a4ea26d2638ebf56fd836f_JaffaCakes118.dll
Size

125KB
MD5

3be23c3d15a4ea26d2638ebf56fd836f
SHA1

b19ca38cc37aca82861350516eed1283652ebed1
SHA256

f212c0f4a2b779de34359c03e293503534c8c849257ac96c9ff17af67b3c4407
SHA512

b516ead9c89b40bc77b714cee068b70ad08b3b1009c5425c15db090a4578ec35a403467028b849ebb703e42ce9141b979bf5f67f77e70bf33d0caa7b29f856eb
SSDEEP

1536:PBsPoYippdVeL4J9tCM8dQRrb9DD4uCZaXGUvEOnt9FtcbVl56H+lropE6JC4PKM:PCPQpxJ9tLxFnFfp+EEQC4Pn/AaPR0o

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 516 wrote to memory of 1700	516	rundll32.exe	83
PID 516 wrote to memory of 1700	516	rundll32.exe	83
PID 516 wrote to memory of 1700	516	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3be23c3d15a4ea26d2638ebf56fd836f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:516
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3be23c3d15a4ea26d2638ebf56fd836f_JaffaCakes118.dll,#1
  2⤵
  PID:1700

memory/1700-0-0x0000000000010000-0x0000000000030000-memory.dmp

Filesize
128KB

Download