2e4d842dc16ec758a4538d0f923956d423ab23af645e6e2a48621c2ad2a300b8

Analysis

max time kernel
141s
max time network
69s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 19:15

Target

25f20c22a9ba8818591b2182c17fbc61_JaffaCakes118.dll
Size

60KB
MD5

25f20c22a9ba8818591b2182c17fbc61
SHA1

0105ad4bf9397bd8a0002509f2634bf15dc9c7fa
SHA256

2e4d842dc16ec758a4538d0f923956d423ab23af645e6e2a48621c2ad2a300b8
SHA512

5c59dcd6c04db8ca33d8d6400536b7dc00e3151ee45d9e18e0338739c533cb3c6749ba658be25f0454dde86ff48be08dd36e23eab4fb989460eeb34d5466b937
SSDEEP

768:KWLcO15vNfGk9R5NOR1YYQSoMI8ahjaHP8shIEK+/YIPDP59p0XyPc2v8QNh:KWL/51frWR5oVMv8izKQPPDuik88QH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4672 wrote to memory of 4404	4672	rundll32.exe	80
PID 4672 wrote to memory of 4404	4672	rundll32.exe	80
PID 4672 wrote to memory of 4404	4672	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\25f20c22a9ba8818591b2182c17fbc61_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\25f20c22a9ba8818591b2182c17fbc61_JaffaCakes118.dll,#1
  2⤵
  PID:4404

memory/4404-0-0x0000000000680000-0x0000000000689000-memory.dmp

Filesize
36KB

Download
memory/4404-1-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download
memory/4404-7-0x0000000000680000-0x0000000000689000-memory.dmp

Filesize
36KB

Download