9fb0d1bc295c917f1f86e971d4a295bfa3dd6d2b4cc2b051de956a329d97c5a2

Analysis

max time kernel
141s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 17:59

Target

4ac98339058e80f5a568be6c805ebba0_JaffaCakes118.dll
Size

72KB
MD5

4ac98339058e80f5a568be6c805ebba0
SHA1

c50d02675e706968ab74784b32bf4ebecc03484a
SHA256

9fb0d1bc295c917f1f86e971d4a295bfa3dd6d2b4cc2b051de956a329d97c5a2
SHA512

a3a73cf882280f598cadbaaabf8cdffb6abfad1c034625ca96077e02370e2bd93559e9416c588b7166cbefb988cf7a55d14ece95596d497557074f31a80f22cc
SSDEEP

1536:RGVPfHg9bk+vRCXT+Qxac9AGWXdib4LNd6PV1UxxW:RGVPIxk+5CXT+YaYqX6PV1U3W

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2408	2060	rundll32.exe	83
PID 2060 wrote to memory of 2408	2060	rundll32.exe	83
PID 2060 wrote to memory of 2408	2060	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4ac98339058e80f5a568be6c805ebba0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4ac98339058e80f5a568be6c805ebba0_JaffaCakes118.dll,#1
  2⤵
  PID:2408

memory/2408-0-0x0000000000EC0000-0x0000000000ECA000-memory.dmp

Filesize
40KB

Download
memory/2408-2-0x0000000010000000-0x0000000010009000-memory.dmp

Filesize
36KB

Download
memory/2408-7-0x0000000000EC0000-0x0000000000ECA000-memory.dmp

Filesize
40KB

Download