8588af1dae51910bc8efa74a3280010d50fee1ebd6bdbb00b662f4447f1b4ff5

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 07:40

Target

40c7d94c94548314f0f5bbab219750ed_JaffaCakes118.dll
Size

49KB
MD5

40c7d94c94548314f0f5bbab219750ed
SHA1

f77bbdb73820b23ed3c191b5195ae68107fedf04
SHA256

8588af1dae51910bc8efa74a3280010d50fee1ebd6bdbb00b662f4447f1b4ff5
SHA512

7260f9ee956d2c20ff4679881d24cc26b7f786330a53ecde73943572449486cef958626b4b1348323d180e8aa35c1ac8117a5fb8685c024e584b2a39c4c810a4
SSDEEP

768:q0I2iwx0CDDcFI8jNrKS/lTzHyRaP3eksNUGEzoVZ3h4MO:q0I2hTAI8DlPyRaPd5hkVNO

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 4204	2264	rundll32.exe	83
PID 2264 wrote to memory of 4204	2264	rundll32.exe	83
PID 2264 wrote to memory of 4204	2264	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\40c7d94c94548314f0f5bbab219750ed_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\40c7d94c94548314f0f5bbab219750ed_JaffaCakes118.dll,#1
  2⤵
  PID:4204

memory/4204-0-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download