3801afabe9beed5cd611523c63338f1c2fe8ee213a6a057e1207174ccd1e2c5c

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 21:15

Target

3ee8ae59711b3cfab364322625be17fe_JaffaCakes118.dll
Size

6KB
MD5

3ee8ae59711b3cfab364322625be17fe
SHA1

adf091471031e2e93c2b8ce0e59b08a5c578b7dd
SHA256

3801afabe9beed5cd611523c63338f1c2fe8ee213a6a057e1207174ccd1e2c5c
SHA512

aceeb9d8bc105a692667475447c26ab0f7e86211d22a9e0370a7f086a787b131ce37bde4a14430bc4826555781b7a30a3c8930e69ebd93e862812b2f0e3ff554
SSDEEP

48:aGy7MN4cpSGAXbIni1kvNs6ztutiKIZWiwQTnU5WwG2QozbC:xB4c4G6bn1k1sw0EW3enIWwGqb

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 3184	1832	rundll32.exe	83
PID 1832 wrote to memory of 3184	1832	rundll32.exe	83
PID 1832 wrote to memory of 3184	1832	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ee8ae59711b3cfab364322625be17fe_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ee8ae59711b3cfab364322625be17fe_JaffaCakes118.dll,#1
  2⤵
  PID:3184

memory/3184-0-0x00000000762F0000-0x00000000762F6000-memory.dmp

Filesize
24KB

Download