7456f66bd201e10cbd33b920948af316a92f175a93ba045ee1d651993d08b059

Analysis

max time kernel
91s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 23:11

Target

2e2bfcc5b241667ce8eda5fe4a601864_JaffaCakes118.dll
Size

309KB
MD5

2e2bfcc5b241667ce8eda5fe4a601864
SHA1

794d29e030aa84ce3ed8d157395ca6293995a832
SHA256

7456f66bd201e10cbd33b920948af316a92f175a93ba045ee1d651993d08b059
SHA512

fc40f536fe2d2c2a3321120c58f8d0f14fa911ca37e12071588e31276cbaa9c9bfc19d2dd5cb2d58d04688073995c44a32126a2bb03c06d437713f7be7c850b8
SSDEEP

6144:pmoXCk+FPV/RkvLt9KZXwm0uEsr9cYN1ItQ/RepGRrdxscwsPwauzHhv0N:pTXCk4iLtEqZ0r9P1qQ/R5VchDdv0

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4540 wrote to memory of 1612	4540	rundll32.exe	82
PID 4540 wrote to memory of 1612	4540	rundll32.exe	82
PID 4540 wrote to memory of 1612	4540	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e2bfcc5b241667ce8eda5fe4a601864_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e2bfcc5b241667ce8eda5fe4a601864_JaffaCakes118.dll,#1
  2⤵
  PID:1612

memory/1612-0-0x0000000001270000-0x0000000001271000-memory.dmp

Filesize
4KB

Download
memory/1612-1-0x0000000013140000-0x000000001329E000-memory.dmp

Filesize
1.4MB

Download