2da09c99a64aab933ada929334c58223118a7b41519371a8641f218e6788984c

Analysis

max time kernel
138s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2024, 05:17

Target

5f2a00119efc0ccc71fae9f8a52707ec_JaffaCakes118.dll
Size

133KB
MD5

5f2a00119efc0ccc71fae9f8a52707ec
SHA1

bc44b0ce1cec98a5ee5d487aec52c8eeea1d9d76
SHA256

2da09c99a64aab933ada929334c58223118a7b41519371a8641f218e6788984c
SHA512

9249f0e8fbc5271f61ca0db2b3301cd4c1ee958e8793a34fe124082064aabd7221918646409c18eeec7b64511ce0e68229f8c8971b9dc7ff2f5958e028f1eeb3
SSDEEP

3072:tgbLo93/nR9QYfB6teFDIOSOaqY/kMsqb4P9X3S:tsLQp9QyB6teFDIOed/kMsqM1y

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 1256	4912	rundll32.exe	86
PID 4912 wrote to memory of 1256	4912	rundll32.exe	86
PID 4912 wrote to memory of 1256	4912	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5f2a00119efc0ccc71fae9f8a52707ec_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5f2a00119efc0ccc71fae9f8a52707ec_JaffaCakes118.dll,#1
  2⤵
  PID:1256

memory/1256-0-0x0000000000860000-0x0000000000886000-memory.dmp

Filesize
152KB

Download