734b6654401bed39bea11dbac2d11f03225c29556474e19ce40461c339df00a3

Analysis

max time kernel
136s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
19/06/2024, 21:05

Target

007c65edfb4b78bd8711f851fda412be_JaffaCakes118.dll
Size

290KB
MD5

007c65edfb4b78bd8711f851fda412be
SHA1

a80245ac1485a0918197986bf679b0f48609de03
SHA256

734b6654401bed39bea11dbac2d11f03225c29556474e19ce40461c339df00a3
SHA512

a16ce26aeab4865882bb0f3b2541854c6852d1a398aa5af41c42c3f8f2665d3fce0fb2651cf05ff93cb8c4379578dca0e4c1c4b4f4ac9ff237e38f561f851a0a
SSDEEP

6144:sopalfXN1ysJtpShJgFox1aG+vLJBRs9jMW6H/i47F9ojBpkpkP+uDq:zpalfXN1ysXQh4oxz+v5pH/x7rrpk2

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 452 wrote to memory of 1556	452	rundll32.exe	82
PID 452 wrote to memory of 1556	452	rundll32.exe	82
PID 452 wrote to memory of 1556	452	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\007c65edfb4b78bd8711f851fda412be_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:452
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\007c65edfb4b78bd8711f851fda412be_JaffaCakes118.dll,#1
  2⤵
  PID:1556

memory/1556-0-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1556-1-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download