26d2547f9a06033ed3bf0d7da536d9849ff8463f93c287791051a2f82fb92f17

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 17:10

Target

3e2eb12eda40bdcf950ee9cec9d247f3_JaffaCakes118.dll
Size

256KB
MD5

3e2eb12eda40bdcf950ee9cec9d247f3
SHA1

d9975ef20afa2a553894c89e4da322c549acc80d
SHA256

26d2547f9a06033ed3bf0d7da536d9849ff8463f93c287791051a2f82fb92f17
SHA512

fd7b6f5f5c6bc7a2b0e69b7dc1198f47aebfe03279d3dfa976e0ccf1cd44fb9fb148be93ea30eb996edb64ae6b18977c4bfbb012fb038ae6c87acdec3924b6ba
SSDEEP

6144:Wjgpn2DcDjIPvp8Hcolx+TNcOLqQ1tgOVVwG/+OF4R1:WjgAeIHp88UYTNcOGQDgOV3/lFC1

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 372	2168	rundll32.exe	83
PID 2168 wrote to memory of 372	2168	rundll32.exe	83
PID 2168 wrote to memory of 372	2168	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3e2eb12eda40bdcf950ee9cec9d247f3_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3e2eb12eda40bdcf950ee9cec9d247f3_JaffaCakes118.dll,#1
  2⤵
  PID:372

memory/372-0-0x0000000068150000-0x0000000068190000-memory.dmp

Filesize
256KB

Download