5362cc2a1fcad102c43e6d767aa13c0e548444a36273504d64546967e777e8f0

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 20:32

Target

2db4af9c2ea84e64a965f5245ef49236_JaffaCakes118.dll
Size

76KB
MD5

2db4af9c2ea84e64a965f5245ef49236
SHA1

240432f57c00b98e25cb76791d472a7005c4530e
SHA256

5362cc2a1fcad102c43e6d767aa13c0e548444a36273504d64546967e777e8f0
SHA512

6a1920ed927245bca8e8c71ffee3f7cac634eaa28d1fe44023aa1359bdd9cdac54ef32b22621db73ecefea9cf362a1ab198f229e03a49626d56e9515be7ae5ee
SSDEEP

768:faCwQlb2PbhM1j1nFjlHdeUNjWEOMVBMXB239UWrVTXKpVsJOOWS81kj6AD9lrw:iCJb2jhOBlnvNjBOMj4B23PK0JOvjUQ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3756 wrote to memory of 1372	3756	rundll32.exe	82
PID 3756 wrote to memory of 1372	3756	rundll32.exe	82
PID 3756 wrote to memory of 1372	3756	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2db4af9c2ea84e64a965f5245ef49236_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2db4af9c2ea84e64a965f5245ef49236_JaffaCakes118.dll,#1
  2⤵
  PID:1372

memory/1372-0-0x00000000009A0000-0x00000000009AA000-memory.dmp

Filesize
40KB

Download
memory/1372-2-0x0000000010000000-0x0000000010009000-memory.dmp

Filesize
36KB

Download
memory/1372-4-0x00000000009A0000-0x00000000009AA000-memory.dmp

Filesize
40KB

Download
memory/1372-8-0x00000000009A0000-0x00000000009AA000-memory.dmp

Filesize
40KB

Download