ac9b785187196dc72529f918192a6a2409f30daddc928a196c2de3d52fe39910

Analysis

max time kernel
136s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 07:26

Target

3c78158100084e8a7fa03302bed6b496_JaffaCakes118.dll
Size

148KB
MD5

3c78158100084e8a7fa03302bed6b496
SHA1

d74afc3dcf084c8fd67aac54baf4f538f291f59e
SHA256

ac9b785187196dc72529f918192a6a2409f30daddc928a196c2de3d52fe39910
SHA512

fde9ac91bc0afd0c2d09e4b6311aaf2a766ebc83f55aff09293c924378fa3fb13e951ed1631503bf2626f38a2c7e268a427ea3863ac25a2a982d5e870d40dde6
SSDEEP

3072:Z+3YYZLrswGq4KoO+u56MqqDLy/TF8ms4akxrVTO:4IYt9x4VO+u5pqqDLuTFLr

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3952 wrote to memory of 4060	3952	rundll32.exe	83
PID 3952 wrote to memory of 4060	3952	rundll32.exe	83
PID 3952 wrote to memory of 4060	3952	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c78158100084e8a7fa03302bed6b496_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c78158100084e8a7fa03302bed6b496_JaffaCakes118.dll,#1
  2⤵
  PID:4060

memory/4060-0-0x0000000000590000-0x000000000059A000-memory.dmp

Filesize
40KB

Download
memory/4060-4-0x0000000010017000-0x000000001002E000-memory.dmp

Filesize
92KB

Download