45f1adcf6044148ddde8a27a65c61a47eedccf1fb7d3cccf492fbb0bdbbd543f

Analysis

max time kernel
139s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 16:09

Target

0eb3fb457ec056d963897d1fb50c7466_JaffaCakes118.dll
Size

375KB
MD5

0eb3fb457ec056d963897d1fb50c7466
SHA1

8451e816a1ebfaec3ca0b7e13c5a05a5e128f27d
SHA256

45f1adcf6044148ddde8a27a65c61a47eedccf1fb7d3cccf492fbb0bdbbd543f
SHA512

cef764164c30c1dacaa51bc5b0765ef99d82a17c894d5bd2e6d901058945daf0babe9185b0a0dc9c2a0b78332f191f9bcba07aa5d0e017a3c3e0a83f9065d6bb
SSDEEP

6144:40jAyfvKneHv2WGzIE5hFwQWE1Krj9YF70yQp/kXrc9catYA/+yxiognDYokgLwR:40l31NWBiS1KjjiX5at7/JrgnrFY24

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 1664	632	rundll32.exe	82
PID 632 wrote to memory of 1664	632	rundll32.exe	82
PID 632 wrote to memory of 1664	632	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0eb3fb457ec056d963897d1fb50c7466_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0eb3fb457ec056d963897d1fb50c7466_JaffaCakes118.dll,#1
  2⤵
  PID:1664

memory/1664-1-0x0000000000680000-0x0000000000780000-memory.dmp

Filesize
1024KB

Download
memory/1664-0-0x0000000010000000-0x0000000010062000-memory.dmp

Filesize
392KB

Download