fa2b86bf75c316ca27c8cfb13369eb5a3f7d3fd65f1e95c404c80edd36e7fb09

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 12:37

Target

49cf3adc8a9f886ab5609a224f015c21_JaffaCakes118.dll
Size

373KB
MD5

49cf3adc8a9f886ab5609a224f015c21
SHA1

692f3d7baf9072f02cc1375b577a0e18b48d69fa
SHA256

fa2b86bf75c316ca27c8cfb13369eb5a3f7d3fd65f1e95c404c80edd36e7fb09
SHA512

1a2a6dae3d78ce2f5932824485dce9eaaeaaae377a41147b9d0447ff91e1c66670bce512a75851db30a257e2db9e1309622b803ccda079021f535615f679a422
SSDEEP

6144:Vg4aHgbjTlIPt/bAIDStvX6g0TJdRd6IwYi5wMVfqRIQLaV:a4aCw/bAImtvX6g0E5wMVyqDV

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5080	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 5080	5064	rundll32.exe	82
PID 5064 wrote to memory of 5080	5064	rundll32.exe	82
PID 5064 wrote to memory of 5080	5064	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\49cf3adc8a9f886ab5609a224f015c21_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\49cf3adc8a9f886ab5609a224f015c21_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:5080

memory/5080-1-0x0000000002AB0000-0x0000000002BB0000-memory.dmp

Filesize
1024KB

Download
memory/5080-0-0x0000000010000000-0x0000000010061000-memory.dmp

Filesize
388KB

Download