3a43a5f72c3a858ccfdf8d0f6f43e3ee74bc35cacf9bcc0b0304d3b3f2cc0ffc

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 19:30

Target

42b6da54d81a2e4ba7dfa99daa8195e7_JaffaCakes118.dll
Size

168KB
MD5

42b6da54d81a2e4ba7dfa99daa8195e7
SHA1

805f134c4df71ff1fa14d04edc4f623e2f01dd8f
SHA256

3a43a5f72c3a858ccfdf8d0f6f43e3ee74bc35cacf9bcc0b0304d3b3f2cc0ffc
SHA512

36884a0cb5f5b1f340e087302e7428874d87681583fc16ed15be50587677eb54a83e9ba96809ee2f5dfd8311d47c186479b1296b10a80cafb7af1632ab72cd2e
SSDEEP

3072:zvj3ceH/rvjpDkQs+12nBkuJIOtAekYYYYYYYYYYYYYYYYYYYYYYYYYYYFYYYYYn:zvjF/T9D8nZIOtXkYYYYYYYYYYYYYYYu

Score

8^/10

Blocklisted process makes network request 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 3696	4364	rundll32.exe	84
PID 4364 wrote to memory of 3696	4364	rundll32.exe	84
PID 4364 wrote to memory of 3696	4364	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\42b6da54d81a2e4ba7dfa99daa8195e7_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\42b6da54d81a2e4ba7dfa99daa8195e7_JaffaCakes118.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:3696

memory/3696-0-0x00000000027A0000-0x00000000027B0000-memory.dmp

Filesize
64KB

Download
memory/3696-1-0x00000000740F2000-0x00000000740F3000-memory.dmp

Filesize
4KB

Download
memory/3696-2-0x00000000740F0000-0x00000000746A1000-memory.dmp

Filesize
5.7MB

Download
memory/3696-13-0x00000000740F0000-0x00000000746A1000-memory.dmp

Filesize
5.7MB

Download
memory/3696-15-0x00000000740F0000-0x00000000746A1000-memory.dmp

Filesize
5.7MB

Download