02e45abfb868c7eb16bc407d69351bcefbaccf56add985dddc4f357f61dc4baf

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2024, 20:22

Target

ebe9d252c4a15a4b6f602a77fd1e10f3_JaffaCakes118.dll
Size

248KB
MD5

ebe9d252c4a15a4b6f602a77fd1e10f3
SHA1

e76a20b8960afa28722b2b216bfa5cc8f2e61029
SHA256

02e45abfb868c7eb16bc407d69351bcefbaccf56add985dddc4f357f61dc4baf
SHA512

bcf861cb165e94cd364cca80f02f76372f157a6513c3394802f5f83ef0d69e45eaf4042d17ec84eac8676569b48ea08ce840ad4dcfc6da3bf6cb22f4fbd416a7
SSDEEP

3072:VXBTrxWWQGGLx4yTMV8Oyxro1c82/yP4aX:VRTrx87UJd1c+n

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 1408	1216	rundll32.exe	85
PID 1216 wrote to memory of 1408	1216	rundll32.exe	85
PID 1216 wrote to memory of 1408	1216	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ebe9d252c4a15a4b6f602a77fd1e10f3_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ebe9d252c4a15a4b6f602a77fd1e10f3_JaffaCakes118.dll,#1
  2⤵
  PID:1408

memory/1408-0-0x0000000002860000-0x0000000002870000-memory.dmp

Filesize
64KB

Download
memory/1408-1-0x0000000075130000-0x00000000756E1000-memory.dmp

Filesize
5.7MB

Download
memory/1408-2-0x0000000075130000-0x00000000756E1000-memory.dmp

Filesize
5.7MB

Download
memory/1408-4-0x0000000075130000-0x00000000756E1000-memory.dmp

Filesize
5.7MB

Download