900b715bdf40685d2ef480cbc9853771d04659c283805704a60c0b1376a62ced

Analysis

max time kernel
93s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 22:46

Target

65190c187adfa4eb8ffe2fdfc3fe29e1_JaffaCakes118.dll
Size

84KB
MD5

65190c187adfa4eb8ffe2fdfc3fe29e1
SHA1

7bbb7005ed9ad366673cafd5d4413701f27292da
SHA256

900b715bdf40685d2ef480cbc9853771d04659c283805704a60c0b1376a62ced
SHA512

18a28e3384a2c3f2c837220804e3bfa687f53b9d1f07e9985e5e5559037966a0cd358a9b8f5dcd3666d5315f90b557089b149ab9bb89d50b53af280ac7d13289
SSDEEP

1536:6KYDlxwgepUROMZzCLYR5qy6oHvF+ZOfN0DrcW+:OZCtpC3zquqy6kvFCO8cW+

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4784 wrote to memory of 2124	4784	rundll32.exe	84
PID 4784 wrote to memory of 2124	4784	rundll32.exe	84
PID 4784 wrote to memory of 2124	4784	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\65190c187adfa4eb8ffe2fdfc3fe29e1_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\65190c187adfa4eb8ffe2fdfc3fe29e1_JaffaCakes118.dll,#1
  2⤵
  PID:2124

memory/2124-0-0x0000000001510000-0x0000000001519000-memory.dmp

Filesize
36KB

Download