5e9671c121bda9d89fd05b294d5ebda3db56f2c9fba0856648d116cb5c87306c

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 04:13

Target

14a43306a99673f7a6fca50a8ba5ab3f_JaffaCakes118.dll
Size

37KB
MD5

14a43306a99673f7a6fca50a8ba5ab3f
SHA1

ad3723f9e3fa9ac7556bb97c271696bbab351028
SHA256

5e9671c121bda9d89fd05b294d5ebda3db56f2c9fba0856648d116cb5c87306c
SHA512

39e90ca62324d285b535b166965ab6cc517b9086b58a722727e3f82e44dbdf4cb99e8f2a1712f91454bf878d4a03be2595048b9243c9ef811f5a0db150836161
SSDEEP

768:faqN6+l5TLAG/4ANjOf5RXKw1AP/qElthT7ngP2hs2bUx:Z6+fTLBwANKR6w1A17N4x

Score

1^/10

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3500 wrote to memory of 1060	3500	rundll32.exe	80
PID 3500 wrote to memory of 1060	3500	rundll32.exe	80
PID 3500 wrote to memory of 1060	3500	rundll32.exe	80
PID 1060 wrote to memory of 2848	1060	rundll32.exe	81
PID 1060 wrote to memory of 2848	1060	rundll32.exe	81
PID 1060 wrote to memory of 2848	1060	rundll32.exe	81
PID 2848 wrote to memory of 720	2848	net.exe	83
PID 2848 wrote to memory of 720	2848	net.exe	83
PID 2848 wrote to memory of 720	2848	net.exe	83
PID 1060 wrote to memory of 1712	1060	rundll32.exe	84
PID 1060 wrote to memory of 1712	1060	rundll32.exe	84
PID 1060 wrote to memory of 1712	1060	rundll32.exe	84
PID 1712 wrote to memory of 2236	1712	net.exe	86
PID 1712 wrote to memory of 2236	1712	net.exe	86
PID 1712 wrote to memory of 2236	1712	net.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\14a43306a99673f7a6fca50a8ba5ab3f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3500
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\14a43306a99673f7a6fca50a8ba5ab3f_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1060
- - C:\Windows\SysWOW64\net.exe
    net stop winss
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2848
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop winss
      4⤵
      PID:720
- - C:\Windows\SysWOW64\net.exe
    net stop OcHealthMon
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1712
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop OcHealthMon
      4⤵
      PID:2236

memory/1060-1-0x00000000009E0000-0x00000000009E5000-memory.dmp

Filesize
20KB

Download
memory/1060-0-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download