a63a39bbb99169cffe5b62942ef2ae19afd97dbd62fe513b6fe8389975742617

Analysis

max time kernel
140s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2024, 22:37

Target

6041d706fdf7fb8fa6896a772e40a65f_JaffaCakes118.dll
Size

11KB
MD5

6041d706fdf7fb8fa6896a772e40a65f
SHA1

a84add275f7f639df6b23475519feb826635924c
SHA256

a63a39bbb99169cffe5b62942ef2ae19afd97dbd62fe513b6fe8389975742617
SHA512

0382e57fa4113c6f5df7816672131f5931f85e00566a5da5ab3f9e64df9108bf2696a8a3810870679f48dd6d84d37801476acbb34ed3be5d9bbf4413617fca0d
SSDEEP

192:y6P1lZSCtyqcKrNXlWkFKj98mXoUg2K6Bh3TYwok7OMAq:y6PDZWQpVJY9zAHw3TBok6lq

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 644	756	rundll32.exe	84
PID 756 wrote to memory of 644	756	rundll32.exe	84
PID 756 wrote to memory of 644	756	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6041d706fdf7fb8fa6896a772e40a65f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6041d706fdf7fb8fa6896a772e40a65f_JaffaCakes118.dll,#1
  2⤵
  PID:644

memory/644-0-0x0000000010001000-0x0000000010003000-memory.dmp

Filesize
8KB

Download