53c2afb02c26b2a6fff668c60de83cd7a24e7ee592335d7053eed7c3d08e2792

Analysis

max time kernel
140s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2024, 18:46

Target

6100e3d8350b141933ec4d605e7f48a4_JaffaCakes118.dll
Size

144KB
MD5

6100e3d8350b141933ec4d605e7f48a4
SHA1

84b117aaa1cc03682a26039aa240e69252878b90
SHA256

53c2afb02c26b2a6fff668c60de83cd7a24e7ee592335d7053eed7c3d08e2792
SHA512

e1cc412031470b8547156eabc3c11458850e5cb31baa771f12d2d254fde362db743c14b53ce07b1d29b899f0bfafb74ffc83dbf6df460d6fdd71888fee3cdade
SSDEEP

1536:uIlL9T5Xx1ogKMvw5Br7KLKLI+Xe+QnyH4Cc0tR6nGVp/VTbkE0DJ4ZwmroV:7tvBOI+FQny5R6nG//SdaZwms

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3612 wrote to memory of 844	3612	rundll32.exe	84
PID 3612 wrote to memory of 844	3612	rundll32.exe	84
PID 3612 wrote to memory of 844	3612	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6100e3d8350b141933ec4d605e7f48a4_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3612
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6100e3d8350b141933ec4d605e7f48a4_JaffaCakes118.dll,#1
  2⤵
  PID:844

memory/844-0-0x000000007C120000-0x000000007C148000-memory.dmp

Filesize
160KB

Download