c133fd452ae321632c6d9cc47cab63c452f6fd5b4072492af87b1b8ac1e1723a

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 09:57

Target

3ce8b33adf1d74e61d6285d57d1be51f_JaffaCakes118.dll
Size

27KB
MD5

3ce8b33adf1d74e61d6285d57d1be51f
SHA1

69d22ca5e34a67222858950ec47fde13f2e5ce0a
SHA256

c133fd452ae321632c6d9cc47cab63c452f6fd5b4072492af87b1b8ac1e1723a
SHA512

bac1f7cf7f56eb669650420aead77911be2d969cfa99860f3c90ea5ee6e7dfefffd5faca2bddb08624079447ae4e58322ae9550c61597a006494d130a96c3920
SSDEEP

768:V2Fkt5mrbHxQP8V0ptNBGkpylM6bEAVYXlX:V2Fkr660V0fNBZAPEA8lX

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4452 wrote to memory of 404	4452	rundll32.exe	83
PID 4452 wrote to memory of 404	4452	rundll32.exe	83
PID 4452 wrote to memory of 404	4452	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ce8b33adf1d74e61d6285d57d1be51f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4452
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ce8b33adf1d74e61d6285d57d1be51f_JaffaCakes118.dll,#1
  2⤵
  PID:404

memory/404-1-0x0000000000A00000-0x0000000000A01000-memory.dmp

Filesize
4KB

Download
memory/404-0-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download
memory/404-2-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download