a8b0cf281a58ea1232964c8ee34249c0ad051de1dde0464a7ecc34ba80b68ca7

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13-07-2024 16:24

Target

42729bea88ab612981c5e8b9ae67ae0d_JaffaCakes118.dll
Size

39KB
MD5

42729bea88ab612981c5e8b9ae67ae0d
SHA1

268f809ff34ef63102b06b050732fca1c194947a
SHA256

a8b0cf281a58ea1232964c8ee34249c0ad051de1dde0464a7ecc34ba80b68ca7
SHA512

6a0376ad57c1fab0b4ef4174cae79331ccb5c31dfabd337c0354e31af81a7671d4575985e0755ad0b1f3df891d1fadd940d3e4c801d1ad45a43ce5c0dbcc96fc
SSDEEP

768:4f2NbRiMg0RU8qglVQwWQswL5Jm7RQWY5PjoRw6kB31H:c29NVQeswt47RGF0kB

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4692 wrote to memory of 1212	4692	rundll32.exe	83
PID 4692 wrote to memory of 1212	4692	rundll32.exe	83
PID 4692 wrote to memory of 1212	4692	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\42729bea88ab612981c5e8b9ae67ae0d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\42729bea88ab612981c5e8b9ae67ae0d_JaffaCakes118.dll,#1
  2⤵
  PID:1212

memory/1212-0-0x0000000002130000-0x0000000002167000-memory.dmp

Filesize
220KB

Download
memory/1212-2-0x0000000002130000-0x0000000002167000-memory.dmp

Filesize
220KB

Download
memory/1212-1-0x0000000002130000-0x0000000002167000-memory.dmp

Filesize
220KB

Download
memory/1212-5-0x0000000002170000-0x0000000002270000-memory.dmp

Filesize
1024KB

Download
memory/1212-4-0x0000000002170000-0x0000000002270000-memory.dmp

Filesize
1024KB

Download
memory/1212-3-0x0000000002170000-0x0000000002270000-memory.dmp

Filesize
1024KB

Download