957d0dbc7d2d1a26fc5d28657d02f777689f68acacbbb38524e1dcf54ad8b8ac

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
04-07-2024 22:05

Target

26655ace84e4eeebe8be48d252b07666_JaffaCakes118.dll
Size

22KB
MD5

26655ace84e4eeebe8be48d252b07666
SHA1

c2ff23f2d413103aad72a757513533618f6cb980
SHA256

957d0dbc7d2d1a26fc5d28657d02f777689f68acacbbb38524e1dcf54ad8b8ac
SHA512

1084f870e26349ec46901afc3a2bd558980ad51a46acc2b8189439b855a3cb03d84b0adf9f6fb293862b700c2ecf7505bb6d73dda9ce17100f56e052a9c8d23c
SSDEEP

384:TeH+tWzlSDrb5+gIS3a2Oaa2pbNGJ38pPJv1TCAxAr6+S9Pfu7n59:dtWurb6SOaVwYxv1TlxndeV9

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 916 wrote to memory of 2600	916	rundll32.exe	rundll32.exe
PID 916 wrote to memory of 2600	916	rundll32.exe	rundll32.exe
PID 916 wrote to memory of 2600	916	rundll32.exe	rundll32.exe
PID 2600 wrote to memory of 3804	2600	rundll32.exe	Wscript.exe
PID 2600 wrote to memory of 3804	2600	rundll32.exe	Wscript.exe
PID 2600 wrote to memory of 3804	2600	rundll32.exe	Wscript.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\26655ace84e4eeebe8be48d252b07666_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:916

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\26655ace84e4eeebe8be48d252b07666_JaffaCakes118.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2600

C:\Windows\SysWOW64\Wscript.exe
Wscript.exe c:\windows\ime\vbs\pp.vbs
3⤵
PID:3804

memory/2600-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download