20030ddbdc15cdabf7c5cb18ad978dd7201169809a4464cefc68cf519c55bf97

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 18:51

Target

faf21750edfbd70d5d34497f87302821_JaffaCakes118.dll
Size

128KB
MD5

faf21750edfbd70d5d34497f87302821
SHA1

8ca9852a009c1d48cef6515dd471aa3ba648f32c
SHA256

20030ddbdc15cdabf7c5cb18ad978dd7201169809a4464cefc68cf519c55bf97
SHA512

84abdec5d4a0cda4e625b77ae7b0c1442d9bf669762063c5c13c0fa7eac74ce4846c15fc28f8c4b3c2e65763c5422d88406f83e55aba4116bda7304115a1f63f
SSDEEP

3072:94sfMsY/e8GmQpUZiJ+9qXdKUJonKtHXedAI7Yiqw:OSMNzQpUZy1o03mY

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3960 wrote to memory of 412	3960	rundll32.exe	85
PID 3960 wrote to memory of 412	3960	rundll32.exe	85
PID 3960 wrote to memory of 412	3960	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\faf21750edfbd70d5d34497f87302821_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\faf21750edfbd70d5d34497f87302821_JaffaCakes118.dll,#1
  2⤵
  PID:412

memory/412-0-0x0000000000E50000-0x0000000000E5D000-memory.dmp

Filesize
52KB

Download
memory/412-2-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download
memory/412-5-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download
memory/412-6-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download