0eaa11648f4d6aaca29fa608b9dcf3bf08b6f052757165796d2ab0fcb227fdbd

Analysis

max time kernel
101s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10-07-2024 21:08

Target

3663e8acde21bb04ae348f725a936fee_JaffaCakes118.dll
Size

359KB
MD5

3663e8acde21bb04ae348f725a936fee
SHA1

095a0f4109c44ab5c47396d8bda129bceb38a493
SHA256

0eaa11648f4d6aaca29fa608b9dcf3bf08b6f052757165796d2ab0fcb227fdbd
SHA512

65eb3d65f030d75034878ad1ec4e620d1b1fa4fb7f8ec0a4c0ee0581f8a21a5b8c0856e8149b9e918937f2fb876c83976b5ab0103bbbead103dec055f8e29287
SSDEEP

6144:J6Sm0KVb1JSREx1LkavVpSTSNHteONXyz0ziaDZaEucdF6N3AbLGiyG8b:J6aASe3rHOoD/6VA/GiyG8

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 400 wrote to memory of 2212	400	rundll32.exe	rundll32.exe
PID 400 wrote to memory of 2212	400	rundll32.exe	rundll32.exe
PID 400 wrote to memory of 2212	400	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3663e8acde21bb04ae348f725a936fee_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:400

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3663e8acde21bb04ae348f725a936fee_JaffaCakes118.dll,#1
2⤵
PID:2212

memory/2212-1-0x0000000010000000-0x000000001005D000-memory.dmp

Filesize
372KB

Download
memory/2212-0-0x0000000002E10000-0x0000000002F10000-memory.dmp

Filesize
1024KB

Download