2dfe63f61806963a11343120137b77ebafa837934f7fab876de26f20571dd83a

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 10:18

Target

4563ffaeb75e2abf95edc047a564922f_JaffaCakes118.dll
Size

96KB
MD5

4563ffaeb75e2abf95edc047a564922f
SHA1

150845c9b55a79221a2b6e722947c7f6f9851eae
SHA256

2dfe63f61806963a11343120137b77ebafa837934f7fab876de26f20571dd83a
SHA512

77feae2f050cffb040d145e837340e00d4e5b1d46d5b585713afcb5b0a835424f744f11bde877aff2d28bac5eccef724d409fafda3edff8fc976b8a8311650f5
SSDEEP

1536:7mv7NegBYUhirXQCK/blh6iOyKDr2hYtMU7x7YwR3:KhYUdXlc2K5z

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4296 wrote to memory of 704	4296	rundll32.exe	83
PID 4296 wrote to memory of 704	4296	rundll32.exe	83
PID 4296 wrote to memory of 704	4296	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4563ffaeb75e2abf95edc047a564922f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4563ffaeb75e2abf95edc047a564922f_JaffaCakes118.dll,#1
  2⤵
  PID:704

memory/704-0-0x0000000000C20000-0x0000000000C2A000-memory.dmp

Filesize
40KB

Download
memory/704-4-0x0000000010008000-0x0000000010019000-memory.dmp

Filesize
68KB

Download