489dffc2e27f58776b0d90498d6fbc71586bb20aa1456ad7ed943b01aa1492a9

Analysis

max time kernel
93s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 06:53

Target

3c607af890cf9290452d7e6382b836fc_JaffaCakes118.dll
Size

40KB
MD5

3c607af890cf9290452d7e6382b836fc
SHA1

ab31abca72f3996dbe9b68263ba97dabea193f90
SHA256

489dffc2e27f58776b0d90498d6fbc71586bb20aa1456ad7ed943b01aa1492a9
SHA512

bf413a6192dd30836f1fc8017bd1c6ae46dfc88858c8a9a0160268d8978b92a66430c9523f569f3270c078ead37b0d3b0b797e2b63a534ecf9ff3661072ea856
SSDEEP

768:DZaD0uZ8nQ63Rsa2wCS4DV5hHFJDkh4mwSLwN2IBcDrXiaynU:cKQ63RZM7hHXD1v2IBArSayU

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 740	4472	rundll32.exe	85
PID 4472 wrote to memory of 740	4472	rundll32.exe	85
PID 4472 wrote to memory of 740	4472	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c607af890cf9290452d7e6382b836fc_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c607af890cf9290452d7e6382b836fc_JaffaCakes118.dll,#1
  2⤵
  PID:740

memory/740-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/740-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/740-2-0x0000000001120000-0x0000000001121000-memory.dmp

Filesize
4KB

Download