24060931cf47b985e97f53cc546c4953d134b9964f56971fafd2c624fac007bb

Analysis

max time kernel
93s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 14:14

Target

3db5f47b7a9845db50971509a3aa37c1_JaffaCakes118.dll
Size

72KB
MD5

3db5f47b7a9845db50971509a3aa37c1
SHA1

9ed831555253bb743393a4881bce778ff998efce
SHA256

24060931cf47b985e97f53cc546c4953d134b9964f56971fafd2c624fac007bb
SHA512

d5f3867261d50f6ade0c6f3db7c5216b4696f4d90e1f911eb9c1efe9da51cd4478713c4d65c7f2424feedaa92aca32d089eeed1562fa4cf46b65fd64e8b9ff33
SSDEEP

1536:be3WupZW+EPV67JiszkTmiTXPgF9jKoL48lrF:be3o+EwQszw7PgrjKoL48lrF

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 1508	2908	rundll32.exe	85
PID 2908 wrote to memory of 1508	2908	rundll32.exe	85
PID 2908 wrote to memory of 1508	2908	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3db5f47b7a9845db50971509a3aa37c1_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3db5f47b7a9845db50971509a3aa37c1_JaffaCakes118.dll,#1
  2⤵
  PID:1508

memory/1508-0-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download