eb15edc6674304938e2440e0a05df9f867875257bd632e14c96458efc04e27c2

Analysis

max time kernel
136s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 02:57

Target
5a327679b759b8bfe05c264b0b1e2e5b_JaffaCakes118.dll
Size 172KB
Sample240719-dfwbgssglb
SHA256 eb15edc6674304938e2440e0a05df9f867875257bd632e14c96458efc04e27c2
MD5 5a327679b759b8bfe05c264b0b1e2e5b
SHA1 646ac49b8d44051885a117fc7f944b910d6c8594
SHA512 e73f07743fdb528a85f622ff1b79e0bd29e81105c15c6c0b407eb8c6df41b94d378da817e9603ceb5726edc3b3b5493c261d9557887a35a6798888cf1ad441fb
SSDEEP 3072:skHEpLQt7BAY96t9+fjZGSr05q+Hn1CtRL/X17NsnIh517ydK6Kl:skHj96tAnr05q+HktRUnIh5AdK6Y
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 3192	2776	rundll32.exe	84
PID 2776 wrote to memory of 3192	2776	rundll32.exe	84
PID 2776 wrote to memory of 3192	2776	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a327679b759b8bfe05c264b0b1e2e5b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a327679b759b8bfe05c264b0b1e2e5b_JaffaCakes118.dll,#1
  2⤵
  PID:3192

memory/3192-0-0x00000000757F0000-0x000000007581C000-memory.dmp

Download