9379680ef0456d0330aefbebd346c290b2157b7522da078ad7535152eb0fbf54

Analysis

max time kernel
92s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08-07-2024 17:03

Target

2d20fca38a28552792d0973ed9a4b4d6_JaffaCakes118.dll
Size

104KB
MD5

2d20fca38a28552792d0973ed9a4b4d6
SHA1

b717979b2e97b339075267a09eb1bf82d6027d8e
SHA256

9379680ef0456d0330aefbebd346c290b2157b7522da078ad7535152eb0fbf54
SHA512

0b035bdce068faa045ee3ae1be893fc1c8f6dbb5efdd43e75f49bb86c0e05c90b5136d0d7a6d006dd6bbd7bc69f123835775cf08398d4cbdd0944f5ce4629328
SSDEEP

3072:m0R0kOUVd2cixJ/aMFA/7rl933OninJRkad0M:mY0khb2cixFk/7XHOiXk2

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 1220	3000	rundll32.exe	82
PID 3000 wrote to memory of 1220	3000	rundll32.exe	82
PID 3000 wrote to memory of 1220	3000	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d20fca38a28552792d0973ed9a4b4d6_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d20fca38a28552792d0973ed9a4b4d6_JaffaCakes118.dll,#1
  2⤵
  PID:1220

memory/1220-0-0x0000000002D70000-0x0000000002D7B000-memory.dmp

Filesize
44KB

Download
memory/1220-4-0x000000001000F000-0x0000000010021000-memory.dmp

Filesize
72KB

Download