b082508aceaeb48fc9e53f549aadba6b4fedb1e1722dcb0cbd2bb5a9529d5d82

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 02:08

Target

47c5f6e9be3f2ad58c6c6408d468eec8_JaffaCakes118.dll
Size

165KB
MD5

47c5f6e9be3f2ad58c6c6408d468eec8
SHA1

b79908c915826dbfd76a551cc32dda6140697a88
SHA256

b082508aceaeb48fc9e53f549aadba6b4fedb1e1722dcb0cbd2bb5a9529d5d82
SHA512

696e6998b825e759366c41c288af637aeed1e574c7447d08d8c6f54c4adbe6596e318df062f4178d95c3a8561b49411836ededd335463c76d554416c1a9ca39f
SSDEEP

3072:VX36n99ARCYlpezLH67yPJf3ksTH8/BL7xOxo/46TnX7I9YU4:h699ARC9XHc6lksTA7xOQ4H9n

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 696 wrote to memory of 1000	696	rundll32.exe	85
PID 696 wrote to memory of 1000	696	rundll32.exe	85
PID 696 wrote to memory of 1000	696	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\47c5f6e9be3f2ad58c6c6408d468eec8_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:696
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\47c5f6e9be3f2ad58c6c6408d468eec8_JaffaCakes118.dll,#1
  2⤵
  PID:1000

memory/1000-0-0x0000000010000000-0x0000000010055000-memory.dmp

Filesize
340KB

Download