3d9554624187990e8f97a22e6169de00f55e90369153e2e520b57201824f54a3

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 10:45

Target

080cc4df2b322fe7fcb491b31cd4dfdc_JaffaCakes118.dll
Size

48KB
MD5

080cc4df2b322fe7fcb491b31cd4dfdc
SHA1

bc9ced4af558e2725279fb05fe62af5664162198
SHA256

3d9554624187990e8f97a22e6169de00f55e90369153e2e520b57201824f54a3
SHA512

da2da5d42e39c624a2d195c67c83d6b6cf2ab870e6f1288f0180e15a8d8522b126e85385302a3734d1bae5d9e1ac8d678fab3992d77e3ea94ff1e45d9a738084
SSDEEP

768:QFo6jfHhiitC8JgceqhcrNZPujT7k/zM9RGStZyPXRXo9r:R6jhthJgceqhcrf2no/zMuf1oJ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 4560	2464	rundll32.exe	81
PID 2464 wrote to memory of 4560	2464	rundll32.exe	81
PID 2464 wrote to memory of 4560	2464	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\080cc4df2b322fe7fcb491b31cd4dfdc_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\080cc4df2b322fe7fcb491b31cd4dfdc_JaffaCakes118.dll,#1
  2⤵
  PID:4560

memory/4560-1-0x0000000002130000-0x0000000002206000-memory.dmp

Filesize
856KB

Download
memory/4560-2-0x0000000002130000-0x0000000002206000-memory.dmp

Filesize
856KB

Download
memory/4560-0-0x00000000007A0000-0x00000000007A1000-memory.dmp

Filesize
4KB

Download