40717f542afa947b3169805462ccef1a7cf1626ee83696e6786505438018c05d

Analysis

max time kernel
93s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 09:09

Target

3cc448d41e31b02169606fa0b6ddf9de_JaffaCakes118.dll
Size

14KB
MD5

3cc448d41e31b02169606fa0b6ddf9de
SHA1

fb81299bd34cee2b5a30121c535447f4c0da965e
SHA256

40717f542afa947b3169805462ccef1a7cf1626ee83696e6786505438018c05d
SHA512

9d41bf902ec80f92f1b7cdfb8ef1663c20578d34a1727f87f4400af736a2cf1cfe7fdd8e4643983d772e39a2f801e00ff9f72e7c2d6ef9908525aa7a053b87a3
SSDEEP

384:uMgUC/f2pmDVRXQQyM9FfuqdVdVoJWf9xsAo4eyg:gUWymXXQFM9Fjd3Vnf9qAU

Score

1^/10

Suspicious behavior: LoadsDriver 31 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 2964	1508	rundll32.exe	83
PID 1508 wrote to memory of 2964	1508	rundll32.exe	83
PID 1508 wrote to memory of 2964	1508	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3cc448d41e31b02169606fa0b6ddf9de_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3cc448d41e31b02169606fa0b6ddf9de_JaffaCakes118.dll,#1
  2⤵
  PID:2964

C:\Users\Admin\AppData\Local\Temp\tmpBB65.tmp

Filesize
3KB

MD5
e896baa87fb8ffdb9a166ffaec8ba5e2

SHA1
f840fabf2c08ca40bdb5bd4b325c102856edaeb8

SHA256
a6e628c7c50fa481aa24dddab96ba9398a8484ba25395d9eabe88e37e4ebcae1

SHA512
e5b9d3723788d09d7be791fb9586a0faf7a03752ba78db0b965a927403d1d065ee03a43f63a7e77ea5cf8d086b06d03d102cd48d5316a091d1482f635487b2b8

Download Submit
C:\name.log

Filesize
58B

MD5
5602febf87bd4c535da2d4e90f56e52b

SHA1
e563ac3a277e614480525dc60061a06afe1a0419

SHA256
569f5ce34e8e491d1b425b57cc90c1463d72eb531983727557802b17c148486b

SHA512
b0e8186706e004b800f3e554171c2a3d8c7391b5d0ba8694380fdfdd12fb09330033a1af29bdc8898a09fabad611aaa98e3deb51d2e4d6e1e0d524b673eddb0f

Download Submit
memory/2964-0-0x0000000025000000-0x000000002501D000-memory.dmp

Filesize
116KB

Download