c5a2452470888835c46d7fdebd4d40088ce03609dc789067d7aefe4e8e4abb76

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 00:47

Target

2e6c8abf001ce08c0d926df4549b5d44_JaffaCakes118.dll
Size

76KB
MD5

2e6c8abf001ce08c0d926df4549b5d44
SHA1

40835f42eeaba1f84c726f26eb549bd47c345ef4
SHA256

c5a2452470888835c46d7fdebd4d40088ce03609dc789067d7aefe4e8e4abb76
SHA512

38ab31d3104742c3de2267a88845db382fecd645a50084f2600d1ef1352c7d9d5f0f2ba415d95d72e605677278e9c17d4cb0dbd3339dffc95b610b27b1cf6f0e
SSDEEP

1536:JhEkiyBylmR4M1/V9JIKKZhFlZkuO3NmmKUBJGbvlCPf/:PExlG4ynCKWhFtO3NmmfBKv+3

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 3588	2412	rundll32.exe	82
PID 2412 wrote to memory of 3588	2412	rundll32.exe	82
PID 2412 wrote to memory of 3588	2412	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e6c8abf001ce08c0d926df4549b5d44_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e6c8abf001ce08c0d926df4549b5d44_JaffaCakes118.dll,#1
  2⤵
  PID:3588

memory/3588-1-0x0000000010000000-0x0000000010029000-memory.dmp

Filesize
164KB

Download
memory/3588-0-0x0000000010012000-0x0000000010021000-memory.dmp

Filesize
60KB

Download