663535101fc03945538a207a02a699669730af39ef4adf719e38c399a4372f05

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 16:06

Target

39d2d80c37ca35115cd2d89a2835be86_JaffaCakes118.dll
Size

14KB
MD5

39d2d80c37ca35115cd2d89a2835be86
SHA1

5ec6c0bf3f5abeb58a67b7a08399664f45ca90d7
SHA256

663535101fc03945538a207a02a699669730af39ef4adf719e38c399a4372f05
SHA512

f6650720bab3a0d12309677383d45115edc5e026fedd44cc3217d5ce618c225c988ac6fed0c872aa29c657ac1be56878d06ee63b87232529f078df21ecdb2e05
SSDEEP

192:0C5VoIj7fHahOPi6kNwBmzFgB451SAU69jSSDCweG/qHBTYCFZ9LQ:p5NH6/NwBmxQn6XDCo/qhcCz9U

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3948 wrote to memory of 1844	3948	rundll32.exe	83
PID 3948 wrote to memory of 1844	3948	rundll32.exe	83
PID 3948 wrote to memory of 1844	3948	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\39d2d80c37ca35115cd2d89a2835be86_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3948
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\39d2d80c37ca35115cd2d89a2835be86_JaffaCakes118.dll,#1
  2⤵
  PID:1844

memory/1844-0-0x0000000010000000-0x0000000010006000-memory.dmp

Filesize
24KB

Download
memory/1844-1-0x0000000010001000-0x0000000010002000-memory.dmp

Filesize
4KB

Download