441d3264686a74b1b524692376384e191b1cc5f0b0ab1cec742cdb77ce79ebfc

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 00:14

Target
3f72ec7aa0ee5089df821c9d1f396538_JaffaCakes118.dll
Size 74KB
Sample240713-ajelcszbpb
SHA256 441d3264686a74b1b524692376384e191b1cc5f0b0ab1cec742cdb77ce79ebfc
MD5 3f72ec7aa0ee5089df821c9d1f396538
SHA1 86486ce438e80d9fc20696a7015c005363edba3a
SHA512 26deae82846c3a33c8d2b566487847c9df0385dc76d948fba13d70a78e7bf023aaf0ec42e9cdfd6ef5c1ae9636d5b31549e81844d60195329c53d2d8e6cd65ec
SSDEEP 1536:3svIM3tv9aS1Y2xj2Ciwe6OVzlADTPX7uPkb3y1n+fGrT9mTtz2:3sv13tv9a6Vawe6AzlOTPqsbC1n+fUk0
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 1152	4476	rundll32.exe	83
PID 4476 wrote to memory of 1152	4476	rundll32.exe	83
PID 4476 wrote to memory of 1152	4476	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f72ec7aa0ee5089df821c9d1f396538_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f72ec7aa0ee5089df821c9d1f396538_JaffaCakes118.dll,#1
  2⤵
  PID:1152

memory/1152-0-0x0000000010000000-0x000000001040E000-memory.dmp

Download