2c8616f3e613e5d2da67c6a2be44b6b6e91215f5bd5c8ebf7bd32629e1397488

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 10:16

Target

0db0da78ec83568841b5087b06ea7d2b_JaffaCakes118.dll
Size

100KB
MD5

0db0da78ec83568841b5087b06ea7d2b
SHA1

bbceccc2b36c399ef8b6018475c4f2cdc51c106c
SHA256

2c8616f3e613e5d2da67c6a2be44b6b6e91215f5bd5c8ebf7bd32629e1397488
SHA512

978b694e0de53427a5a63030458748bf7181bfd666ef4987b683d7501ed092a2341f52651bb22b55ed28cc973bd01ad5d9a385e46b40d1eccb7c009bf261469d
SSDEEP

3072:crfbRdt0ponOI2O/j8XQqGKxY0weLr7zb:chdt0poOhG3F0Z7

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 644	956	rundll32.exe	81
PID 956 wrote to memory of 644	956	rundll32.exe	81
PID 956 wrote to memory of 644	956	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0db0da78ec83568841b5087b06ea7d2b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0db0da78ec83568841b5087b06ea7d2b_JaffaCakes118.dll,#1
  2⤵
  PID:644

memory/644-0-0x0000000002700000-0x000000000270D000-memory.dmp

Filesize
52KB

Download
memory/644-5-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download
memory/644-2-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download
memory/644-7-0x0000000002700000-0x0000000002740000-memory.dmp

Filesize
256KB

Download
memory/644-6-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download
memory/644-9-0x0000000002700000-0x0000000002740000-memory.dmp

Filesize
256KB

Download