f1376cd4391dad4c6dd5c01366a9e6a3be5e8ea4a91ad762b12909d122fdc2ae

Analysis

max time kernel
93s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 21:31

Target

3ac8d6cd9bbae47adbe51814e28eb5d3_JaffaCakes118.dll
Size

37KB
MD5

3ac8d6cd9bbae47adbe51814e28eb5d3
SHA1

36054659728ef9a05ef7f44865d8e2399378539b
SHA256

f1376cd4391dad4c6dd5c01366a9e6a3be5e8ea4a91ad762b12909d122fdc2ae
SHA512

3c28568fec4b38ad3f0dcf7f8e7b8779a56ba45e5d2237c71125dc7ea2691ddc8f7d841ae1bec8d8d16c1e938e8a18c292336278fb3579f8f657ae987d122418
SSDEEP

768:uB4BulmtjP+VsgTeCuvgnHrVxtmhqoC/++j:WVlmtjPYLyLviVx8gL

Score

1^/10

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3748 wrote to memory of 4168	3748	rundll32.exe	83
PID 3748 wrote to memory of 4168	3748	rundll32.exe	83
PID 3748 wrote to memory of 4168	3748	rundll32.exe	83
PID 4168 wrote to memory of 4596	4168	rundll32.exe	85
PID 4168 wrote to memory of 4596	4168	rundll32.exe	85
PID 4168 wrote to memory of 4596	4168	rundll32.exe	85
PID 4596 wrote to memory of 2552	4596	net.exe	88
PID 4596 wrote to memory of 2552	4596	net.exe	88
PID 4596 wrote to memory of 2552	4596	net.exe	88
PID 4168 wrote to memory of 2768	4168	rundll32.exe	89
PID 4168 wrote to memory of 2768	4168	rundll32.exe	89
PID 4168 wrote to memory of 2768	4168	rundll32.exe	89
PID 2768 wrote to memory of 1056	2768	net.exe	91
PID 2768 wrote to memory of 1056	2768	net.exe	91
PID 2768 wrote to memory of 1056	2768	net.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ac8d6cd9bbae47adbe51814e28eb5d3_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3748
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ac8d6cd9bbae47adbe51814e28eb5d3_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4168
- - C:\Windows\SysWOW64\net.exe
    net stop winss
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4596
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop winss
      4⤵
      PID:2552
- - C:\Windows\SysWOW64\net.exe
    net stop OcHealthMon
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2768
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop OcHealthMon
      4⤵
      PID:1056

memory/4168-0-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/4168-1-0x0000000000CF0000-0x0000000000CF5000-memory.dmp

Filesize
20KB

Download
memory/4168-2-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/4168-3-0x0000000000CF0000-0x0000000000CF5000-memory.dmp

Filesize
20KB

Download