8aad4a03f98d44fe7baf4ad2861a97c25c24d4c949302b98de2c9aedce18e755

Analysis

max time kernel
148s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 10:52

Target

62f274a1b070e23032185aa98bcfdce5_JaffaCakes118.dll
Size

123KB
MD5

62f274a1b070e23032185aa98bcfdce5
SHA1

78acae2fc40d3b0213bd84d111643d616783306f
SHA256

8aad4a03f98d44fe7baf4ad2861a97c25c24d4c949302b98de2c9aedce18e755
SHA512

b7de20fb971609079dcb3f669d590f503a67415f8c2d7d54c7bee30162af6fec8e10ba8628ecc90fddee3e6a292fd504b2ae22a81782eefdc983f608403076b8
SSDEEP

3072:YAUYWPxfm+k8Q5BlscTNC356W8YgXesYKiVFMTtXE7W:nUYWNmBVKx35mXesi

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1052 wrote to memory of 4948	1052	rundll32.exe	84
PID 1052 wrote to memory of 4948	1052	rundll32.exe	84
PID 1052 wrote to memory of 4948	1052	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\62f274a1b070e23032185aa98bcfdce5_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\62f274a1b070e23032185aa98bcfdce5_JaffaCakes118.dll,#1
  2⤵
  PID:4948

memory/4948-0-0x00000000021B0000-0x00000000021E9000-memory.dmp

Filesize
228KB

Download