f19f3af31c102bb600bdd5f71dad9d95846a981671db68f35daa9d24055e422a

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 15:32

Target

466e0f1012511123639c08c9299fb8aa_JaffaCakes118.dll
Size

135KB
MD5

466e0f1012511123639c08c9299fb8aa
SHA1

951a8eac769d8b7d438d5fde8e1cf8c926da6eea
SHA256

f19f3af31c102bb600bdd5f71dad9d95846a981671db68f35daa9d24055e422a
SHA512

a25ebb266c4fc31658b601428602bfc1125ebd12cd55b6a3107e4681034a96d332b7338ac1def3069cfc886566d076a3ab760279fe3f99d08729301f67f78213
SSDEEP

3072:S+4bMXkhr/qsZ8TZMfvft5zh/y1XeuoSMqqDLy/1yd:SvbMXM8T+NpyXeDqqDLu1y

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 2396	1864	rundll32.exe	84
PID 1864 wrote to memory of 2396	1864	rundll32.exe	84
PID 1864 wrote to memory of 2396	1864	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\466e0f1012511123639c08c9299fb8aa_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\466e0f1012511123639c08c9299fb8aa_JaffaCakes118.dll,#1
  2⤵
  PID:2396

memory/2396-0-0x0000000002CD0000-0x0000000002CDA000-memory.dmp

Filesize
40KB

Download
memory/2396-4-0x000000001001C000-0x000000001002D000-memory.dmp

Filesize
68KB

Download