ca0f11cbd5f94c2d2e09fdb2d58ffa376e3daaaedf3db7cc6fb862d8c8bf55a8

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
07-05-2024 05:11

Target

1f8dd0a9d1940ed96906bea43706c944_JaffaCakes118.dll
Size

7.1MB
MD5

1f8dd0a9d1940ed96906bea43706c944
SHA1

2240524101c0232e6dbca400fd333827779a3a51
SHA256

ca0f11cbd5f94c2d2e09fdb2d58ffa376e3daaaedf3db7cc6fb862d8c8bf55a8
SHA512

7399bb4c4adc8c9d9bf5e6ddcb5250e3557d38440a8838c3e8942e669ba0b7fdaed5a07df540620a800a343e23f2a208d80b944aeeaead2c1eac233c7f1529fb
SSDEEP

196608:c5Zb2lDI/EyZGs39r9hTHwHekznap2XhlHaD3tZfyNsKdaLyExNx:i2l08yZ9tr9hcH3znM2PutyaKdTExNx

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3580	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3580	rundll32.exe
3580	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1020 wrote to memory of 3580	1020	rundll32.exe	84
PID 1020 wrote to memory of 3580	1020	rundll32.exe	84
PID 1020 wrote to memory of 3580	1020	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1f8dd0a9d1940ed96906bea43706c944_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1f8dd0a9d1940ed96906bea43706c944_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:3580

memory/3580-0-0x000000007421C000-0x0000000074691000-memory.dmp

Filesize
4.5MB

Download
memory/3580-1-0x0000000074140000-0x0000000074DA4000-memory.dmp

Filesize
12.4MB

Download
memory/3580-3-0x0000000001590000-0x0000000001591000-memory.dmp

Filesize
4KB

Download
memory/3580-2-0x00000000013D0000-0x00000000013D1000-memory.dmp

Filesize
4KB

Download
memory/3580-5-0x0000000074140000-0x0000000074DA4000-memory.dmp

Filesize
12.4MB

Download
memory/3580-7-0x0000000074140000-0x0000000074DA4000-memory.dmp

Filesize
12.4MB

Download
memory/3580-8-0x0000000074140000-0x0000000074DA4000-memory.dmp

Filesize
12.4MB

Download
memory/3580-9-0x000000007421C000-0x0000000074691000-memory.dmp

Filesize
4.5MB

Download