2e0876a236694377c4a9abb303887c51784877717f2adf1267b68f546daf37cc

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 05:57

Target

3c38b2e91cc58e554a36c373d3991b2f_JaffaCakes118.dll
Size

60KB
MD5

3c38b2e91cc58e554a36c373d3991b2f
SHA1

44c43e9d61d8ef587d8f005734809a6879188068
SHA256

2e0876a236694377c4a9abb303887c51784877717f2adf1267b68f546daf37cc
SHA512

88b64acff9053223a434b09dd44e13ce2175bfffee73f86ce26fd5801284dce72e340ac74b22049d4eb3f9fe7a384a91598a9bc7ffad7b2339910778c5dbb859
SSDEEP

768:MF36ihpP3/j1ZmU/kqMTVhLLvivsqNgYR64vhb36Wk:MF3dxL/bsqMTDYsq8ab4

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1576 wrote to memory of 1228	1576	rundll32.exe	83
PID 1576 wrote to memory of 1228	1576	rundll32.exe	83
PID 1576 wrote to memory of 1228	1576	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c38b2e91cc58e554a36c373d3991b2f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c38b2e91cc58e554a36c373d3991b2f_JaffaCakes118.dll,#1
  2⤵
  PID:1228

memory/1228-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1228-1-0x0000000000C60000-0x0000000000C61000-memory.dmp

Filesize
4KB

Download