ce486fb62417c8c2c2f1bc8a18e49fcff365cb743050ee325e1186dd1fac8f6a

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 11:29

Target

38eea221cf131e4a5aa702c783e2efc4_JaffaCakes118.dll
Size

188KB
MD5

38eea221cf131e4a5aa702c783e2efc4
SHA1

81f70ab72f8e16dbab6bf69b0bab67fed72d210f
SHA256

ce486fb62417c8c2c2f1bc8a18e49fcff365cb743050ee325e1186dd1fac8f6a
SHA512

8c60dc94f7b6793ede5ef9fd9a460abb3e48c8800200c27154c506800b395745e7797a2330d71ef272483721fc1a45e05b3e206e5fc21b9cd2530dcba4832cae
SSDEEP

3072:08cpg+NnXvU+2tD5rtNvUY9Da4J4Z/vmhZT8MZKs:08GpNnXSvU34J4ZQZT8Bs

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 208	5036	rundll32.exe	83
PID 5036 wrote to memory of 208	5036	rundll32.exe	83
PID 5036 wrote to memory of 208	5036	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\38eea221cf131e4a5aa702c783e2efc4_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\38eea221cf131e4a5aa702c783e2efc4_JaffaCakes118.dll,#1
  2⤵
  PID:208

memory/208-0-0x00000000025E0000-0x00000000025E6000-memory.dmp

Filesize
24KB

Download
memory/208-1-0x0000000010001000-0x0000000010003000-memory.dmp

Filesize
8KB

Download