a1996da6494787b3fbd6f9bb8b06a86bd822e62656ca7ded0197972e427a3e46

Analysis

max time kernel
93s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12-07-2024 12:15

Target

3d566c5eb497791e4cd581df71183ffb_JaffaCakes118.dll
Size

2.2MB
MD5

3d566c5eb497791e4cd581df71183ffb
SHA1

b63d751d2a1981ca2746955ee557815ef4eb2afc
SHA256

a1996da6494787b3fbd6f9bb8b06a86bd822e62656ca7ded0197972e427a3e46
SHA512

390a30c65c205fa9468565c8da1ce80725ab569fb3d19050544cca260ffd8515d567ac80f79a3de42c166509ec956423d189c582445628c02595f9d3f4d1fec7
SSDEEP

49152:hu2XG8ZoI9Z9rqyI44HppuzGxHHY4L2q5HkL+eUYWHsiJNXvkUr:JWGoqZ92yVG/uzGNV9HkAVHL/Dr

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 3648	1732	rundll32.exe	83
PID 1732 wrote to memory of 3648	1732	rundll32.exe	83
PID 1732 wrote to memory of 3648	1732	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d566c5eb497791e4cd581df71183ffb_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d566c5eb497791e4cd581df71183ffb_JaffaCakes118.dll,#1
  2⤵
  PID:3648

memory/3648-0-0x0000000010000000-0x000000001006C000-memory.dmp

Filesize
432KB

Download