3bb5fda51b462069647db633b62a28e46de2efaa6ab11d600c10fab00337ad99

Analysis

max time kernel
94s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10-07-2024 12:18

Target

34afa5e0d9afed72fc9e6a27823a7153_JaffaCakes118.dll
Size

96KB
MD5

34afa5e0d9afed72fc9e6a27823a7153
SHA1

7fabaf926dcb925f6638856543cd2d2896373730
SHA256

3bb5fda51b462069647db633b62a28e46de2efaa6ab11d600c10fab00337ad99
SHA512

eceddb15161ee7127b462bfff8661e4fe7f1e45b2dcf68a766d53cd6cdf9ab55a94fd87247666f914bc960a105b72565e8ea04896e0d6e5bc4aa6737274764ec
SSDEEP

1536:yRZdpI/IS+r8Rb9i79S0BlPKWmf2vw0EElzlBd0LvhRGeDr62Rsot6EtH:x/JRO00Bl4N0Eyznd+vhRG0+4H

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3312 wrote to memory of 2276	3312	rundll32.exe	82
PID 3312 wrote to memory of 2276	3312	rundll32.exe	82
PID 3312 wrote to memory of 2276	3312	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\34afa5e0d9afed72fc9e6a27823a7153_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3312
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\34afa5e0d9afed72fc9e6a27823a7153_JaffaCakes118.dll,#1
  2⤵
  PID:2276

memory/2276-0-0x00000000020F0000-0x0000000002307000-memory.dmp

Filesize
2.1MB

Download
memory/2276-1-0x0000000010000000-0x0000000010217000-memory.dmp

Filesize
2.1MB

Download
memory/2276-3-0x00000000020F0000-0x0000000002307000-memory.dmp

Filesize
2.1MB

Download