1206ed8911f2104bdb60da72fe1e66d6dd7c6d3223e5f31e3dae7f84a0b75e4b

Analysis

max time kernel
143s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 12:32

Target

45d4353b3cac76555c080a203584506f_JaffaCakes118.dll
Size

9KB
MD5

45d4353b3cac76555c080a203584506f
SHA1

be2169b6bc83083759b2d3264f00ca284fa2952b
SHA256

1206ed8911f2104bdb60da72fe1e66d6dd7c6d3223e5f31e3dae7f84a0b75e4b
SHA512

638679e5355b6ecf40083de5e64a2a229786cb64886df3bc518ffe6499e56de5929e2358ec5951d6f9561a5531497db742e49156a06595bd891a42162b17f07a
SSDEEP

192:Cl8VlRx9UV7aqW4ej5LxWPfmOKc7XHu1w8qx8D0Bymn1dJRiRWkgUwz8:m8V3x9sujxOKcDew8qeqtRizx

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 4460	940	rundll32.exe	85
PID 940 wrote to memory of 4460	940	rundll32.exe	85
PID 940 wrote to memory of 4460	940	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\45d4353b3cac76555c080a203584506f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\45d4353b3cac76555c080a203584506f_JaffaCakes118.dll,#1
  2⤵
  PID:4460

memory/4460-0-0x0000000025000000-0x0000000025016000-memory.dmp

Filesize
88KB

Download