9a835744b1659c3a650a7a79e812a55b2cfb30769130c73f8fd05a5af8d986c3

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 19:56

Target

4b2bb86d4b97c29f4f6071ee561b82be_JaffaCakes118.dll
Size

175KB
MD5

4b2bb86d4b97c29f4f6071ee561b82be
SHA1

56ceeb5a805c8b65827f974161f409b3adbb7de6
SHA256

9a835744b1659c3a650a7a79e812a55b2cfb30769130c73f8fd05a5af8d986c3
SHA512

bb67d148f39465b0e5a8298d01c0b7565312b1bd2fb5522f1983609aa73b210460eb51f69f8d64d5e6c76f212e1e46ed7f013dc30e7fe6aa9441a879c3037099
SSDEEP

3072:gFordc4GojdMzWNUOkixjw1goe0qZCcGrFrY2WZ0cr2Ovm/DtqRz5Smy:uordcObNUOXxj1CceFmrS/DtqvS

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 2068	4884	rundll32.exe	83
PID 4884 wrote to memory of 2068	4884	rundll32.exe	83
PID 4884 wrote to memory of 2068	4884	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b2bb86d4b97c29f4f6071ee561b82be_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b2bb86d4b97c29f4f6071ee561b82be_JaffaCakes118.dll,#1
  2⤵
  PID:2068

memory/2068-0-0x0000000001F00000-0x0000000001F32000-memory.dmp

Filesize
200KB

Download