dab19ac2df23564c29e832358cb7cae2a6979f171b87243619871fe4400ee2d3

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12-07-2024 18:04

Target

3e55c36e533925ee0f09aae2198ecbf0_JaffaCakes118.dll
Size

757KB
MD5

3e55c36e533925ee0f09aae2198ecbf0
SHA1

fb5faddd40af8886e91593a44bedda08532d71c7
SHA256

dab19ac2df23564c29e832358cb7cae2a6979f171b87243619871fe4400ee2d3
SHA512

643429f9a9849fb02367aa8d292791fabea2e296adba9bb87893b1d89ddbf3efd8de3cbbf0d4ebca4ab16960a621dd84079003ccb6a46f7464f35f75d3df2e17
SSDEEP

192:musClZr/XUL8/wrAbJzO5no/ndQT03pszVnkJoD9bsh4jzsNhsPypHBJKIg1CG3C:tsC8QgANGQT4kmDRTi2mBJKIp5

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 4888	4940	rundll32.exe	83
PID 4940 wrote to memory of 4888	4940	rundll32.exe	83
PID 4940 wrote to memory of 4888	4940	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3e55c36e533925ee0f09aae2198ecbf0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3e55c36e533925ee0f09aae2198ecbf0_JaffaCakes118.dll,#1
  2⤵
  PID:4888

memory/4888-0-0x0000000020000000-0x0000000020008000-memory.dmp

Filesize
32KB

Download