91c0dcc1b916f8770e22ef49390d1c9f699862127dfa9a00d254a5f278d2ae9b

Analysis

max time kernel
94s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 16:19

Target

4695fd125eda3189fce0585100c8db04_JaffaCakes118.dll
Size

72KB
MD5

4695fd125eda3189fce0585100c8db04
SHA1

26494eda68e9f027ed4d0d022fdd13d3c72d5b97
SHA256

91c0dcc1b916f8770e22ef49390d1c9f699862127dfa9a00d254a5f278d2ae9b
SHA512

d6e85ed99fce661ceffb73df2449f72c9818c6935a77111cb8b96bc171af2541dac2337feb40b4901ddb1fac9b484ffe265bc89e6e82fca497e9182e78e36917
SSDEEP

1536:YRMaoGWbOvAIcN/Tw/RJkToNJnAPMT1oWGfHhQT3C:YRMaoQtaw/RJe4lRJnkHqTS

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3488 wrote to memory of 3720	3488	rundll32.exe	83
PID 3488 wrote to memory of 3720	3488	rundll32.exe	83
PID 3488 wrote to memory of 3720	3488	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4695fd125eda3189fce0585100c8db04_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3488
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4695fd125eda3189fce0585100c8db04_JaffaCakes118.dll,#1
  2⤵
  PID:3720

memory/3720-0-0x0000000010000000-0x0000000010032000-memory.dmp

Filesize
200KB

Download