a8879b24b6e72c2d955d9314739057f25884bae5190a0308a26adc851fd2ef0f

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 17:27

Target

4aac6f19ad725dedaf7088aae7fa5562_JaffaCakes118.dll
Size

137KB
MD5

4aac6f19ad725dedaf7088aae7fa5562
SHA1

9e6d66113ef595cda9d65eb57b7ab1a34585b569
SHA256

a8879b24b6e72c2d955d9314739057f25884bae5190a0308a26adc851fd2ef0f
SHA512

b79383f0ae4ca1216ceeb2ff4d49bbc95de80434d3877765a5f83cbdd9b16e0f401bfb4730411adc862b2c4a0cee536ed86f284ff29ab97855f262ac7d1ad11d
SSDEEP

3072:jKFE0XvcbGOV37QYhQrHWiQtpV2wT83L5hMvWr08VvX:jUX0GU71hQr2iqwCM08x

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 3568	3004	rundll32.exe	83
PID 3004 wrote to memory of 3568	3004	rundll32.exe	83
PID 3004 wrote to memory of 3568	3004	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4aac6f19ad725dedaf7088aae7fa5562_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4aac6f19ad725dedaf7088aae7fa5562_JaffaCakes118.dll,#1
  2⤵
  PID:3568

memory/3568-0-0x0000000010000000-0x000000001003B000-memory.dmp

Filesize
236KB

Download
memory/3568-1-0x00000000028C0000-0x0000000002A5D000-memory.dmp

Filesize
1.6MB

Download
memory/3568-4-0x0000000010000000-0x000000001003B000-memory.dmp

Filesize
236KB

Download
memory/3568-3-0x0000000010000000-0x000000001003B000-memory.dmp

Filesize
236KB

Download
memory/3568-2-0x0000000010000000-0x000000001003B000-memory.dmp

Filesize
236KB

Download
memory/3568-5-0x0000000010000000-0x000000001003B000-memory.dmp

Filesize
236KB

Download