db8296d8de6545f25a847f813d7641b7e6100ab1663b9c7db31daccf813edee6

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 10:02

Target

f7c3af01f189ea3492d53ed93ed3c599_JaffaCakes118.dll
Size

130KB
MD5

f7c3af01f189ea3492d53ed93ed3c599
SHA1

db73a251754347b227028abbb03d4d7b5dd8c995
SHA256

db8296d8de6545f25a847f813d7641b7e6100ab1663b9c7db31daccf813edee6
SHA512

e3fdf853d1cad3be286e1c23d69ca23b679939805563f47b57e8cb9c76c01505daaa507471c16d156efbb9f477e648fdd6266784007d38c909c8e71223614b2f
SSDEEP

3072:Ei2ewByXiTMh/T7T1HufF6XTr8uF+bDGNTMek:t2JByXiTM7Hut6XY/GNTMek

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 4968	4264	rundll32.exe	84
PID 4264 wrote to memory of 4968	4264	rundll32.exe	84
PID 4264 wrote to memory of 4968	4264	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f7c3af01f189ea3492d53ed93ed3c599_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f7c3af01f189ea3492d53ed93ed3c599_JaffaCakes118.dll,#1
  2⤵
  PID:4968

memory/4968-0-0x0000000010000000-0x0000000010026000-memory.dmp

Filesize
152KB

Download
memory/4968-1-0x0000000010000000-0x0000000010026000-memory.dmp

Filesize
152KB

Download