0206a95d984b2c9571cf8c2d5b6cde62740357f28841dd204d359d8a68dc2b8f

Analysis

max time kernel
92s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 02:26

Target

3fd313fb87b2487e7b6a23d8fcbb18da_JaffaCakes118.dll
Size

164KB
MD5

3fd313fb87b2487e7b6a23d8fcbb18da
SHA1

af4b5a5afe39434c6f2a570b7a15676f5ce111cc
SHA256

0206a95d984b2c9571cf8c2d5b6cde62740357f28841dd204d359d8a68dc2b8f
SHA512

ef8907a838eeb50e39f7cc3aee1e0ae59ab83c698613187b7540ccf2221b48880f29367e59b94300c68621de7925f4e7d1383dc3c53f85b2f5c6a08a65316f8e
SSDEEP

3072:RFykeLfHq4Mqaw5m8cF/KV6/ppA+VRhHdgXu8jd1lNcSwoZUYfO:HvaqME/he+7UpdNcSpfO

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4216 wrote to memory of 4560	4216	rundll32.exe	83
PID 4216 wrote to memory of 4560	4216	rundll32.exe	83
PID 4216 wrote to memory of 4560	4216	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3fd313fb87b2487e7b6a23d8fcbb18da_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3fd313fb87b2487e7b6a23d8fcbb18da_JaffaCakes118.dll,#1
  2⤵
  PID:4560

memory/4560-0-0x000000001001C000-0x000000001002E000-memory.dmp

Filesize
72KB

Download
memory/4560-1-0x0000000000AE0000-0x0000000000AEA000-memory.dmp

Filesize
40KB

Download