16639b58f0951ed3272b637ea59e465b317cf2fe98c26266132c9c4c925f5ba4

Analysis

max time kernel
148s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 14:28

Target

39825f90f32324ccb17dd5fc121d522b_JaffaCakes118.dll
Size

14KB
MD5

39825f90f32324ccb17dd5fc121d522b
SHA1

87fbfce73a97f17a171ffc27a6fa6b52e1944d9e
SHA256

16639b58f0951ed3272b637ea59e465b317cf2fe98c26266132c9c4c925f5ba4
SHA512

a5196ee65fb5b761904524a5e0212fb549b588cab82d480746afdb8623fa93520d50f180d9b9f97a89836eb909b4399f1092e33cebab1f0f153a19c826a05bca
SSDEEP

384:NcA3ZGPNikcapYaqvA4VOa4QxV3eawYcQQlmGwnYrxi2K:NV3NapiYfKNzBf5GgUx0

Score

1^/10

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 2964	5112	rundll32.exe	85
PID 5112 wrote to memory of 2964	5112	rundll32.exe	85
PID 5112 wrote to memory of 2964	5112	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\39825f90f32324ccb17dd5fc121d522b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\39825f90f32324ccb17dd5fc121d522b_JaffaCakes118.dll,#1
  2⤵
  PID:2964

memory/2964-0-0x0000000025000000-0x000000002501F000-memory.dmp

Filesize
124KB

Download