ed1e1e97ccaf598c5aa11c0b58aa78e1887b8199efd3251116573ee270472586

Analysis

max time kernel
93s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2024, 18:07

Target

60e0c76dab80076d75d19a839aa5d840_JaffaCakes118.dll
Size

61KB
MD5

60e0c76dab80076d75d19a839aa5d840
SHA1

d4ffcca7cb2f886d9dc8729c9e6ae6e41f329bc0
SHA256

ed1e1e97ccaf598c5aa11c0b58aa78e1887b8199efd3251116573ee270472586
SHA512

8103a0cbd7341e1a4f84aad5b34767af14ebd9c9ab6e9ca5280443eca7d30c3e3ac8cd75638d8de427490ca53dd1268b8a7fd7c94b0f1fc6dc9b10cc5d556aeb
SSDEEP

768:VBhe4tujjKsBQfMKlYBOEWNBJrMZ7wADrlL1Va4AVdyjACKwbs2j+t:siax4CBhAMZ7B44e2Lj+t

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 4884	1744	rundll32.exe	84
PID 1744 wrote to memory of 4884	1744	rundll32.exe	84
PID 1744 wrote to memory of 4884	1744	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\60e0c76dab80076d75d19a839aa5d840_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\60e0c76dab80076d75d19a839aa5d840_JaffaCakes118.dll,#1
  2⤵
  PID:4884

memory/4884-0-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download