0e859bd598f16e162c02e9c74a8d38de64429d2acec20742aeb975b40205ec3a

Analysis

max time kernel
141s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 19:52

Target

260ee6c702ba0fd322f656ea0985cca0_JaffaCakes118.dll
Size

60KB
MD5

260ee6c702ba0fd322f656ea0985cca0
SHA1

b303e76a1634f38abf5c1dc9709dd9f2976bd9f6
SHA256

0e859bd598f16e162c02e9c74a8d38de64429d2acec20742aeb975b40205ec3a
SHA512

88583b0311653ec46b630f798be63447e96894ae1a298cb9a6c08f0f40805fbeac14f1962a162a2e8ff644e126661435422ce8d73483850b7862cbbe213006fe
SSDEEP

768:fovqSo4WMZVjPl5g0MLw16BcWG2RsMVBhhUwahuF6iPsZCY2WIaxyGIXH35Yzm:foSS/7XjPKM2RsCTUsFDPsR/XypnEm

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 1756	2444	rundll32.exe	80
PID 2444 wrote to memory of 1756	2444	rundll32.exe	80
PID 2444 wrote to memory of 1756	2444	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\260ee6c702ba0fd322f656ea0985cca0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\260ee6c702ba0fd322f656ea0985cca0_JaffaCakes118.dll,#1
  2⤵
  PID:1756

memory/1756-0-0x0000000000DC0000-0x0000000000DC9000-memory.dmp

Filesize
36KB

Download
memory/1756-1-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download
memory/1756-7-0x0000000000DC0000-0x0000000000DC9000-memory.dmp

Filesize
36KB

Download