b9be0cea34974a9db17c45d380adbae5575922b437aad1711519375bad73df6c

Analysis

max time kernel
95s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 13:07

Target

49e88308c1de7b56ac1efbf1bfac8d4f_JaffaCakes118.dll
Size

148KB
MD5

49e88308c1de7b56ac1efbf1bfac8d4f
SHA1

00e11212ab57163f7e52ab8e99831f61046c2d54
SHA256

b9be0cea34974a9db17c45d380adbae5575922b437aad1711519375bad73df6c
SHA512

3565a6b62d7bb8609858d434402a4533dd3fe6bea6fc1f6b1aa2d7ba77144b443deba6eae0f885016cc2cfe8db5bf34dec3a2c706a72600b20aed361320c0477
SSDEEP

3072:ZSTYT06LrsC554KoZVop6MqqDLy/TF8ms4akxYWTO:UsTfzH4VZVoppqqDLuTFLY

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 932 wrote to memory of 1444	932	rundll32.exe	83
PID 932 wrote to memory of 1444	932	rundll32.exe	83
PID 932 wrote to memory of 1444	932	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\49e88308c1de7b56ac1efbf1bfac8d4f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:932
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\49e88308c1de7b56ac1efbf1bfac8d4f_JaffaCakes118.dll,#1
  2⤵
  PID:1444

memory/1444-4-0x0000000010017000-0x000000001002E000-memory.dmp

Filesize
92KB

Download
memory/1444-0-0x0000000002BA0000-0x0000000002BAA000-memory.dmp

Filesize
40KB

Download