99599e4f8fe834a44dfef430cf65489396add1f56d8c7a0b4fab43aadacb4d78

Analysis

max time kernel
94s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11-07-2024 10:07

Target

38afbe230f1f0f233f46cfe181d42a5d_JaffaCakes118.dll
Size

56KB
MD5

38afbe230f1f0f233f46cfe181d42a5d
SHA1

0a735b2704caed82f6d5e20c1b0bfd293e13253a
SHA256

99599e4f8fe834a44dfef430cf65489396add1f56d8c7a0b4fab43aadacb4d78
SHA512

e5dad90d91d0d0f58810e46eb51cab4680ad585a0516730a9920337c1f6a91d739b89540d25a16726a9f7b06159f3ae6efbd47c0c9c0172e89d5c3fa2ef8ad5e
SSDEEP

768:1pON/xpyeAXo9JEAUmr0JhbKtw8MA6XTzCuJe:uN/CposThb+w8fmCA

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4260 wrote to memory of 5044	4260	rundll32.exe	83
PID 4260 wrote to memory of 5044	4260	rundll32.exe	83
PID 4260 wrote to memory of 5044	4260	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\38afbe230f1f0f233f46cfe181d42a5d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\38afbe230f1f0f233f46cfe181d42a5d_JaffaCakes118.dll,#1
  2⤵
  PID:5044

memory/5044-0-0x0000000010001000-0x0000000010002000-memory.dmp

Filesize
4KB

Download
memory/5044-1-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download