8be4478f462cd4e7121345ce7f8473bc8f4eeb85ded47d1dd3f64a460e239c2a

Analysis

max time kernel
135s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 21:21

Target

f69a05506bc855fb33acd854ffabdd0e_JaffaCakes118.dll
Size

118KB
MD5

f69a05506bc855fb33acd854ffabdd0e
SHA1

ec87953b6473edcc22f0797e8de96eea8b7c8f53
SHA256

8be4478f462cd4e7121345ce7f8473bc8f4eeb85ded47d1dd3f64a460e239c2a
SHA512

bbd1c9b00cf5797134cd5a1e0f7d242eb23d7650099ba2659b66cfcc3c147fa61503e1f073e53aadc49c31abe462666f442a4869b3b0a373d7d82fcaf6c04dc5
SSDEEP

1536:h72hXk9WV3m/lcJQDKzw9jUPxxXIh0FCVNG3Q/qIh0FCVNG3Q/ygt:hn9kqlVtY5xXzoG3QCzoG3Qqgt

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4244 wrote to memory of 3676	4244	rundll32.exe	86
PID 4244 wrote to memory of 3676	4244	rundll32.exe	86
PID 4244 wrote to memory of 3676	4244	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f69a05506bc855fb33acd854ffabdd0e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4244
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f69a05506bc855fb33acd854ffabdd0e_JaffaCakes118.dll,#1
  2⤵
  PID:3676

memory/3676-0-0x0000000010000000-0x0000000010022000-memory.dmp

Filesize
136KB

Download
memory/3676-1-0x0000000000950000-0x0000000000972000-memory.dmp

Filesize
136KB

Download
memory/3676-3-0x0000000077852000-0x0000000077853000-memory.dmp

Filesize
4KB

Download
memory/3676-2-0x00000000009B0000-0x00000000009D2000-memory.dmp

Filesize
136KB

Download
memory/3676-4-0x0000000077852000-0x0000000077853000-memory.dmp

Filesize
4KB

Download
memory/3676-5-0x0000000000BA0000-0x0000000000BA1000-memory.dmp

Filesize
4KB

Download
memory/3676-6-0x00000000021E0000-0x00000000021E1000-memory.dmp

Filesize
4KB

Download
memory/3676-7-0x0000000077852000-0x0000000077853000-memory.dmp

Filesize
4KB

Download
memory/3676-8-0x0000000000BB0000-0x0000000000BC4000-memory.dmp

Filesize
80KB

Download
memory/3676-11-0x0000000010000000-0x0000000010022000-memory.dmp

Filesize
136KB

Download
memory/3676-12-0x00000000009B0000-0x00000000009D2000-memory.dmp

Filesize
136KB

Download