1ede40d41aa03e6a7f7c4256e70e73321a6bf6d7c8667360399cc3fb743afb99

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 09:59

Target

1593ed0853cce87249f59494f48639c0_JaffaCakes118.dll
Size

83KB
MD5

1593ed0853cce87249f59494f48639c0
SHA1

1f430875b1833ccd0ace4d5ead67ac78feeefe43
SHA256

1ede40d41aa03e6a7f7c4256e70e73321a6bf6d7c8667360399cc3fb743afb99
SHA512

d7a8d43a673e977f024980777cc67af341f430a944988e5c0753dd2c06dc3feda7a52fae32c938ac03669c9209678f9018f6e53097d0a3d22fd603a535f51e84
SSDEEP

1536:ezF6/duFnAXvt7M2OGiNyeIPcrqTWn5q112GLyYZkvUXg0xVF3:ey0AXj5iNyPpT4bG2akvUXg21

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 1800	1032	rundll32.exe	83
PID 1032 wrote to memory of 1800	1032	rundll32.exe	83
PID 1032 wrote to memory of 1800	1032	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1593ed0853cce87249f59494f48639c0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1593ed0853cce87249f59494f48639c0_JaffaCakes118.dll,#1
  2⤵
  PID:1800

memory/1800-0-0x0000000010000000-0x0000000010038000-memory.dmp

Filesize
224KB

Download
memory/1800-1-0x0000000000D50000-0x0000000000D51000-memory.dmp

Filesize
4KB

Download