90240e2869f3afada472da3781fc4e19b15e75b5e50fe1a63caf19d6f2a52ec9

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/04/2024, 11:43

Target

ed572dd733ce79ea5a4545491aae19f4_JaffaCakes118.dll
Size

420KB
MD5

ed572dd733ce79ea5a4545491aae19f4
SHA1

6c93bd436929afc4aa5204bcc0f3236273828ade
SHA256

90240e2869f3afada472da3781fc4e19b15e75b5e50fe1a63caf19d6f2a52ec9
SHA512

be7377d7587f3d7067d469bb06933bdeb5bf79e2c15fad76844374635436c36eaaf402504c1a70229d3d05682b344ad7a4e2177df1b72a803e55d1c0cb768001
SSDEEP

6144:4UryYkXSmckr4MszVkTdAPwbiXR8xZg3OSr84Dpx6HiNm:4URkr4MMWdwfXR8x+nr8YcHio

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3696 wrote to memory of 4144	3696	rundll32.exe	84
PID 3696 wrote to memory of 4144	3696	rundll32.exe	84
PID 3696 wrote to memory of 4144	3696	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ed572dd733ce79ea5a4545491aae19f4_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3696
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ed572dd733ce79ea5a4545491aae19f4_JaffaCakes118.dll,#1
  2⤵
  PID:4144

memory/4144-0-0x0000000002A20000-0x0000000002A21000-memory.dmp

Filesize
4KB

Download
memory/4144-1-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/4144-2-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/4144-3-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/4144-4-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/4144-5-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/4144-6-0x0000000002A70000-0x0000000002AD3000-memory.dmp

Filesize
396KB

Download
memory/4144-7-0x0000000002A79000-0x0000000002A7A000-memory.dmp

Filesize
4KB

Download
memory/4144-8-0x0000000002B20000-0x0000000002B48000-memory.dmp

Filesize
160KB

Download
memory/4144-9-0x0000000002A70000-0x0000000002AD3000-memory.dmp

Filesize
396KB

Download