1d651984a3710637a677d3fb8a2980de3d20a2ce4fcd1fb24ea1233f7f4f48af

Analysis

max time kernel
132s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 14:06

Target

1a690c4404dcd818c7173898ecfd9d5d_JaffaCakes118.dll
Size

106KB
MD5

1a690c4404dcd818c7173898ecfd9d5d
SHA1

b12a6401f6251769df720320ec11c56008b4b75d
SHA256

1d651984a3710637a677d3fb8a2980de3d20a2ce4fcd1fb24ea1233f7f4f48af
SHA512

efddb659ab2cad83ee379014c185ef456e70096a3e3a05b057ffdeca4996ee483af5c864ef1a769d21628e7b1ba3eddf359c963d33d4f2c3d3d0efa32cedd88d
SSDEEP

3072:47Az8ZUob2eUtcHqIjvToAeNsu9BGnMgf5g297F9MSN:sAzToCcHqIDeNsu9gMgf5f9r

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3736 wrote to memory of 4640	3736	rundll32.exe	83
PID 3736 wrote to memory of 4640	3736	rundll32.exe	83
PID 3736 wrote to memory of 4640	3736	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a690c4404dcd818c7173898ecfd9d5d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3736
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a690c4404dcd818c7173898ecfd9d5d_JaffaCakes118.dll,#1
  2⤵
  PID:4640

memory/4640-0-0x0000000002AE0000-0x0000000002AEE000-memory.dmp

Filesize
56KB

Download
memory/4640-1-0x0000000002B00000-0x0000000002B1D000-memory.dmp

Filesize
116KB

Download
memory/4640-5-0x0000000002AE0000-0x0000000002AE1000-memory.dmp

Filesize
4KB

Download
memory/4640-6-0x0000000002AE0000-0x0000000002AE1000-memory.dmp

Filesize
4KB

Download