697fc7453127cc9da260d6f12d13f9a50c7f2c6446efd1f394be4655b8456ef2

Analysis

max time kernel
99s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 22:29

Target

470d737059bdc671b891347c0c1c54e4_JaffaCakes118.dll
Size

53KB
MD5

470d737059bdc671b891347c0c1c54e4
SHA1

74df0af8d2ea0d49dd0a72f8ca49bd749255cebb
SHA256

697fc7453127cc9da260d6f12d13f9a50c7f2c6446efd1f394be4655b8456ef2
SHA512

c218990040ece996b68a6e5e5db95d00db0b465d112fb5af2834e1925c6d1d87eea55158744de4946847acaefbc77f2bba67054f62f02651a906f03bb9943da3
SSDEEP

1536:2Iy1bJAfx0i2W2q75Z4dzRTNI4KZ8EJhu3xJ0L:2IMJAfx0i2Wf75+dzRTIqMu3x4

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 1892	5072	rundll32.exe	83
PID 5072 wrote to memory of 1892	5072	rundll32.exe	83
PID 5072 wrote to memory of 1892	5072	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\470d737059bdc671b891347c0c1c54e4_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\470d737059bdc671b891347c0c1c54e4_JaffaCakes118.dll,#1
  2⤵
  PID:1892

memory/1892-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1892-1-0x0000000000990000-0x0000000000991000-memory.dmp

Filesize
4KB

Download