814076f73eb1c4e1a97586f243835063421cbad9d7a1a71df00fb7898c5e7adb

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08-07-2024 22:04

Target

2df9ef831acf33c0dd7d864846ab062c_JaffaCakes118.dll
Size

329KB
MD5

2df9ef831acf33c0dd7d864846ab062c
SHA1

06f6cbbf6a6cd4e17391dc7672e91432eb485ef4
SHA256

814076f73eb1c4e1a97586f243835063421cbad9d7a1a71df00fb7898c5e7adb
SHA512

e8b4bb66790fb10d5385543e8e9fa6114734b0aae9441e3eb8d41a38a3298f56761fe7a2be70f464e4d5079ba7d37f45918896c9632415d56581a031d053c548
SSDEEP

6144:IPLfPatz0fiqhHNknDK68JuMdw5yLSeOSD2h+kTjh3EQJpv:Oatz0bhH4K688RQLqT+kpU

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 384 wrote to memory of 4940	384	rundll32.exe	82
PID 384 wrote to memory of 4940	384	rundll32.exe	82
PID 384 wrote to memory of 4940	384	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2df9ef831acf33c0dd7d864846ab062c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:384
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2df9ef831acf33c0dd7d864846ab062c_JaffaCakes118.dll,#1
  2⤵
  PID:4940

memory/4940-0-0x0000000010000000-0x00000000100DC000-memory.dmp

Filesize
880KB

Download