4b5546077baa0a1a733698ee036899c4763c50c918a2d50aa7cf6d35c30cbac8

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240708-en
resource tags

arch:x64arch:x86image:win10v2004-20240708-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 11:44

Target

2c363d068f42a910fa8470698baa09be_JaffaCakes118.dll
Size

136KB
MD5

2c363d068f42a910fa8470698baa09be
SHA1

a00ae6923a8bbdd077745a1e0e429891093dc185
SHA256

4b5546077baa0a1a733698ee036899c4763c50c918a2d50aa7cf6d35c30cbac8
SHA512

1608d7fa88e43654bc1af63977bdf9f507e541b40857886a61559647e26216d7d34a041c527796095537ff09749e9ba390e0e91254cf6d003c60c3243b04906b
SSDEEP

3072:3obvCkGLLLhn1b30i/6fOkReKlee4lvg:YbyN1T0iyfO/Fe4t

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 404 wrote to memory of 4728	404	rundll32.exe	80
PID 404 wrote to memory of 4728	404	rundll32.exe	80
PID 404 wrote to memory of 4728	404	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c363d068f42a910fa8470698baa09be_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:404
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c363d068f42a910fa8470698baa09be_JaffaCakes118.dll,#1
  2⤵
  PID:4728

C:\Windows\system32\WerFault.exe
"C:\Windows\system32\WerFault.exe" -k -l WATCHDOG WATCHDOG-20240708-1900.dmp
1⤵
PID:2984