1f9575d813b0fe36c47749c577d7554fa8755acb4e583ed3e9ee9ae100c0da4a

Analysis

max time kernel
140s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21-07-2024 23:29

Target

61dcd9e921708ee3809cec1aac331d61_JaffaCakes118.dll
Size

572KB
MD5

61dcd9e921708ee3809cec1aac331d61
SHA1

508e298210aeab7b9d0bfec22a900d905b125d9d
SHA256

1f9575d813b0fe36c47749c577d7554fa8755acb4e583ed3e9ee9ae100c0da4a
SHA512

b225fa9fc80dc2d41bce4a6158de8f31957849cacfe55357819df34a974451fa355dbf2b54604ba84c2a335a76012e64b8895b5c6d1acd95393b174517aaf3de
SSDEEP

12288:bTLhkkQ9UXm4/tDT7V0iN21dmmBhcSKkApimZoIjOCsXptO:jakPXpB7GiN+HKHsICTtO

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4668 wrote to memory of 2016	4668	rundll32.exe	84
PID 4668 wrote to memory of 2016	4668	rundll32.exe	84
PID 4668 wrote to memory of 2016	4668	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\61dcd9e921708ee3809cec1aac331d61_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4668
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\61dcd9e921708ee3809cec1aac331d61_JaffaCakes118.dll,#1
  2⤵
  PID:2016

memory/2016-0-0x00000000021D0000-0x0000000002252000-memory.dmp

Filesize
520KB

Download