d76b855ff48d1553ec5ce429603e306ae19699373d80d2fcba7f9eecfa127fd9

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 04:10

Target

3beffdc3d99d8d29c009e50c24580eac_JaffaCakes118.dll
Size

36KB
MD5

3beffdc3d99d8d29c009e50c24580eac
SHA1

b813ef675965fbe810c5eb241091d76a7e655bb0
SHA256

d76b855ff48d1553ec5ce429603e306ae19699373d80d2fcba7f9eecfa127fd9
SHA512

bd4ae264c5a2f0ada149a0680d601ec18bd1e78b614191314755528f791016b49f5d3e3dd762d7d77f85991451d4a5b9ff06541f6046d35586dab7f90332a0c4
SSDEEP

768:P1jT7mkOoqXa88lhAQ0+TAs+Ckw3UAr5AB9aDG9BKipipGH8:P1jyoqq88yI+CDP6jkGiX

Score

1^/10

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1332 wrote to memory of 3052	1332	rundll32.exe	83
PID 1332 wrote to memory of 3052	1332	rundll32.exe	83
PID 1332 wrote to memory of 3052	1332	rundll32.exe	83
PID 3052 wrote to memory of 724	3052	rundll32.exe	86
PID 3052 wrote to memory of 724	3052	rundll32.exe	86
PID 3052 wrote to memory of 724	3052	rundll32.exe	86
PID 724 wrote to memory of 1136	724	net.exe	88
PID 724 wrote to memory of 1136	724	net.exe	88
PID 724 wrote to memory of 1136	724	net.exe	88
PID 3052 wrote to memory of 4352	3052	rundll32.exe	89
PID 3052 wrote to memory of 4352	3052	rundll32.exe	89
PID 3052 wrote to memory of 4352	3052	rundll32.exe	89
PID 4352 wrote to memory of 2232	4352	net.exe	91
PID 4352 wrote to memory of 2232	4352	net.exe	91
PID 4352 wrote to memory of 2232	4352	net.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3beffdc3d99d8d29c009e50c24580eac_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1332
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3beffdc3d99d8d29c009e50c24580eac_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3052
- - C:\Windows\SysWOW64\net.exe
    net stop winss
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:724
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop winss
      4⤵
      PID:1136
- - C:\Windows\SysWOW64\net.exe
    net stop OcHealthMon
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4352
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop OcHealthMon
      4⤵
      PID:2232

memory/3052-1-0x0000000001200000-0x0000000001205000-memory.dmp

Filesize
20KB

Download
memory/3052-0-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/3052-2-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/3052-3-0x0000000001200000-0x0000000001205000-memory.dmp

Filesize
20KB

Download