e35bd3f6f83b752bddd665b25af5825ca8a7d006ae16b11229677acbe0b12ee4

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 14:45

Target

09220c6065a0ba6773fda4a610bce972_JaffaCakes118.dll
Size

124KB
MD5

09220c6065a0ba6773fda4a610bce972
SHA1

091f9a99464fbbab12d886e2470427ee826bc774
SHA256

e35bd3f6f83b752bddd665b25af5825ca8a7d006ae16b11229677acbe0b12ee4
SHA512

32861c1521d53ffe9f6168c336c428019825737b505daa0cbb28d6bbb7030e6e98d473c477d20f101140cff8904ab53eaf96efbe5bdc42aa9d1788bd0a5fe581
SSDEEP

3072:hjFbZ1oI2cWCwz9rma8HlWEhW8OiCcofwWg:hjdxJuMaIO8od

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3736 wrote to memory of 2932	3736	rundll32.exe	81
PID 3736 wrote to memory of 2932	3736	rundll32.exe	81
PID 3736 wrote to memory of 2932	3736	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\09220c6065a0ba6773fda4a610bce972_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3736
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\09220c6065a0ba6773fda4a610bce972_JaffaCakes118.dll,#1
  2⤵
  PID:2932

memory/2932-0-0x0000000000FD0000-0x0000000000FDB000-memory.dmp

Filesize
44KB

Download
memory/2932-2-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download
memory/2932-4-0x0000000000FD0000-0x0000000000FD1000-memory.dmp

Filesize
4KB

Download