f1f7db1eab121506b2e4ed00dbf212e7a2ec00b2f9695b18a7ae70316ce62734

Analysis

max time kernel
139s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 23:57

Target

c53e13f7b28deeaeb8a2ded5509d81d7_JaffaCakes118.dll
Size

383KB
MD5

c53e13f7b28deeaeb8a2ded5509d81d7
SHA1

14f78040a43c2131db6177252ec72468ac5ecb9d
SHA256

f1f7db1eab121506b2e4ed00dbf212e7a2ec00b2f9695b18a7ae70316ce62734
SHA512

032b92bf55f7fe65d9a52f313221e7316acef359720c6672cb2489cc1727062277fe68463deaebf1ae6c77de18b2ccb69638af2ca32d76f54a742e41f3896451
SSDEEP

6144:iStHxwU6Dx3U9djcq7sADkLbKKFqyk+XbyDzkEFUJdy0E3LHTeE7YrHp6Gg:Uv3iAq7sIiX2ky3Hzd+Hp61

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 3076	4136	rundll32.exe	84
PID 4136 wrote to memory of 3076	4136	rundll32.exe	84
PID 4136 wrote to memory of 3076	4136	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c53e13f7b28deeaeb8a2ded5509d81d7_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c53e13f7b28deeaeb8a2ded5509d81d7_JaffaCakes118.dll,#1
  2⤵
  PID:3076

memory/3076-0-0x0000000074B50000-0x0000000074BB6000-memory.dmp

Filesize
408KB

Download
memory/3076-1-0x0000000074B50000-0x0000000074BB6000-memory.dmp

Filesize
408KB

Download