ea085ef6d521046a0cf00556fa65892d20a3fb0dc35ff0e0e8d965856e64da4f

Analysis

max time kernel
141s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 07:55

Target

f9daf78868ffd7c6fe582e48b66939a4_JaffaCakes118.dll
Size

120KB
MD5

f9daf78868ffd7c6fe582e48b66939a4
SHA1

6d40c8bcdc919543579f7fd30456ef2af1ec7da6
SHA256

ea085ef6d521046a0cf00556fa65892d20a3fb0dc35ff0e0e8d965856e64da4f
SHA512

767e9b428f16345b1e7ce8eba3096950a0bb68a7eeb6a9fda7519b567d2c479254b89dfdff9c45b7fdb0f456b096e0787b7129c84db85ffb1417ead21a8c93c3
SSDEEP

3072:2WWos0SgsfcwLGGQ0aNScn4Y4ULFQ9CuM8p0:2RgMSGBrcn439zM8p0

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4360 wrote to memory of 2460	4360	rundll32.exe	rundll32.exe
PID 4360 wrote to memory of 2460	4360	rundll32.exe	rundll32.exe
PID 4360 wrote to memory of 2460	4360	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f9daf78868ffd7c6fe582e48b66939a4_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4360

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f9daf78868ffd7c6fe582e48b66939a4_JaffaCakes118.dll,#1
2⤵
PID:2460

memory/2460-0-0x00000000001E0000-0x00000000001EB000-memory.dmp

Filesize
44KB

Download
memory/2460-2-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download
memory/2460-5-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download