77285489793fb44ea58352bb341a5ae24154035faedc62a71132b6b38a07b23f

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11-07-2024 19:59

Target

3a86335d0cfdd1ebb7e5a3cd74e568d0_JaffaCakes118.dll
Size

238KB
MD5

3a86335d0cfdd1ebb7e5a3cd74e568d0
SHA1

a863db87c491f5f203f3b6efa8302f2800eba0a9
SHA256

77285489793fb44ea58352bb341a5ae24154035faedc62a71132b6b38a07b23f
SHA512

86387d64c55cc6b86fc88a8dcfef13a8bea8cbf12c24f77cc47e9f76f2cd413eab8276c949961afe5b43009db48059207d79549749ed189889257caed27b76b1
SSDEEP

3072:myjnIT9IDtodEBUHwQX/XQBUAq2WV7Kl78J6kWtygRUAUXwSbiLnp2T+:myj4Sr6Hwo4RqhVGmDmyq1UgSOLI

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 4408	632	rundll32.exe	85
PID 632 wrote to memory of 4408	632	rundll32.exe	85
PID 632 wrote to memory of 4408	632	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a86335d0cfdd1ebb7e5a3cd74e568d0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a86335d0cfdd1ebb7e5a3cd74e568d0_JaffaCakes118.dll,#1
  2⤵
  PID:4408

memory/4408-0-0x0000000002AE0000-0x0000000002AF0000-memory.dmp

Filesize
64KB

Download
memory/4408-1-0x00000000743DE000-0x00000000743DF000-memory.dmp

Filesize
4KB

Download
memory/4408-2-0x0000000004F00000-0x0000000004F44000-memory.dmp

Filesize
272KB

Download