d5f466a8da68f5e8cd4100d99344c1c6a44916d64f6cc891270f48db61a05ab2

Analysis

max time kernel
93s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 21:36

Target

3210d110f466a3b31bccf8cc02930d9b_JaffaCakes118.dll
Size

129KB
MD5

3210d110f466a3b31bccf8cc02930d9b
SHA1

a9cc429958dce5484861eabb0a836ee5bf0e9bec
SHA256

d5f466a8da68f5e8cd4100d99344c1c6a44916d64f6cc891270f48db61a05ab2
SHA512

e7b43454466d18d279ea6e40d3b2fb3f4472ee85d2ef52160050e443200a2bd5c0c67a19ce7a9d850a32c132211400b60e7ef5001565a698e5da8445713d4cd7
SSDEEP

3072:BGQBXt7Qqd9CrdQf3SsAViH5FZjH8CMpR7IN5O3:QQBXt7Qqd9UQfPvFZcCiRMN5

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 2388	1096	rundll32.exe	81
PID 1096 wrote to memory of 2388	1096	rundll32.exe	81
PID 1096 wrote to memory of 2388	1096	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3210d110f466a3b31bccf8cc02930d9b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3210d110f466a3b31bccf8cc02930d9b_JaffaCakes118.dll,#1
  2⤵
  PID:2388

memory/2388-0-0x0000000010000000-0x0000000010033000-memory.dmp

Filesize
204KB

Download
memory/2388-1-0x0000000002E70000-0x0000000002E80000-memory.dmp

Filesize
64KB

Download
memory/2388-2-0x0000000002E70000-0x0000000002E80000-memory.dmp

Filesize
64KB

Download
memory/2388-4-0x0000000010000000-0x0000000010033000-memory.dmp

Filesize
204KB

Download