6f1bd13b8c7b30a4c38506c2537008846c73aacb40f46e1be36594166d4096ca

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2024, 05:20

Target

5f2cdb590f7e02bca7bd968bf1b4f899_JaffaCakes118.dll
Size

328KB
MD5

5f2cdb590f7e02bca7bd968bf1b4f899
SHA1

1498b45bcfb54c797d96e9f386ba8d860a53231f
SHA256

6f1bd13b8c7b30a4c38506c2537008846c73aacb40f46e1be36594166d4096ca
SHA512

919b1617775541b0d793169a6eb95a8ea61fdc9524127971d06b8b8462796d52192659942270eca402a59668d8bbe89edd872f38e8ce3950e9024404b30868a1
SSDEEP

6144:HfSG6C2aOymb+ce1M/Cs6HA3oGJYpWzBHcy85ktKEVQnMquAO4wakt:HfSG6C2aOymlGMjYdpWzp8SvVQnMqu9H

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 4908	2984	rundll32.exe	84
PID 2984 wrote to memory of 4908	2984	rundll32.exe	84
PID 2984 wrote to memory of 4908	2984	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5f2cdb590f7e02bca7bd968bf1b4f899_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5f2cdb590f7e02bca7bd968bf1b4f899_JaffaCakes118.dll,#1
  2⤵
  PID:4908

memory/4908-0-0x0000000010000000-0x000000001009C000-memory.dmp

Filesize
624KB

Download