cd936a273c2414fc61366fa2fd64b5adc3c17c7f0737829537c6be72f6fec277

Analysis

max time kernel
141s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
14-07-2024 09:50

Target

454de037287c2e3670a3f9143de031ba_JaffaCakes118.dll
Size

16KB
MD5

454de037287c2e3670a3f9143de031ba
SHA1

c3c4909de7bdbd4ce925a2e5e12a1bafb85b9dc9
SHA256

cd936a273c2414fc61366fa2fd64b5adc3c17c7f0737829537c6be72f6fec277
SHA512

6c030ef38091c889d661d6aa206e5efb7a19965c87f0bf6ccc7e94af08a99f1f369234e7e909482bb32ec04b46f8223666bb37a206ba46d30b3238dd2e8293cd
SSDEEP

384:2xSDqRyY9pGT5SywikbuXIx3WetR0XqrZi:XY7Gd/whbBxGez0XqY

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 4740	4748	rundll32.exe	85
PID 4748 wrote to memory of 4740	4748	rundll32.exe	85
PID 4748 wrote to memory of 4740	4748	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\454de037287c2e3670a3f9143de031ba_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\454de037287c2e3670a3f9143de031ba_JaffaCakes118.dll,#1
  2⤵
  PID:4740

memory/4740-0-0x0000000000600000-0x0000000000606000-memory.dmp

Filesize
24KB

Download