3128cc01ac3b67456fb9cc2cd9052e6d17dcb989e7d9ed8326c51e332b88834f

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 00:28

Target

43cecd48df2118cae90b8395751ffe67_JaffaCakes118.dll
Size

44KB
MD5

43cecd48df2118cae90b8395751ffe67
SHA1

872e262def17e879c48cfdeee2edbfdae215e1f5
SHA256

3128cc01ac3b67456fb9cc2cd9052e6d17dcb989e7d9ed8326c51e332b88834f
SHA512

9961e31563a2c0862102177c12d887c99b489ab76e8e6767f0a2b29f90a900f4bd3561deb9a6e41ae8857d8577612a21db116922270ab1f3b05887a1cd36864a
SSDEEP

768:iFl1FVrw7CfXQ4SVde2QKDuvqtNYUYmDHARv3MGD8/lc6:CnEtNf7DHo3MGY/l3

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 2908	1140	rundll32.exe	83
PID 1140 wrote to memory of 2908	1140	rundll32.exe	83
PID 1140 wrote to memory of 2908	1140	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\43cecd48df2118cae90b8395751ffe67_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\43cecd48df2118cae90b8395751ffe67_JaffaCakes118.dll,#1
  2⤵
  PID:2908

memory/2908-0-0x000000000F190000-0x000000000F1A2000-memory.dmp

Filesize
72KB

Download