2ab6326b8ff66cae5d3652dc0b74f3487ce05c7ce5951da700e5fd0682f1b808

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15-07-2024 18:05

Target

4ace65dd03f5bdd7d19f6c977ccb1b77_JaffaCakes118.dll
Size

6KB
MD5

4ace65dd03f5bdd7d19f6c977ccb1b77
SHA1

7be4d911138668234b9c120844b5e62fb1147aef
SHA256

2ab6326b8ff66cae5d3652dc0b74f3487ce05c7ce5951da700e5fd0682f1b808
SHA512

ff0c621f8c3f22fff9aa6280fcaf443bde189012ae099bef577d33d47be85faa5596fa492a805f3e944d8522bdb924d748a23e04f1395d608c3eeaac402d1b68
SSDEEP

48:aGy7MN4cpSGAXbIni1kvNs6ztutiKIZWiwQTnU5WwG2QozbC:xB4c4G6bn1k1sw0EW3enIWwGqb

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 212	4580	rundll32.exe	83
PID 4580 wrote to memory of 212	4580	rundll32.exe	83
PID 4580 wrote to memory of 212	4580	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4ace65dd03f5bdd7d19f6c977ccb1b77_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4ace65dd03f5bdd7d19f6c977ccb1b77_JaffaCakes118.dll,#1
  2⤵
  PID:212

memory/212-0-0x00000000762F0000-0x00000000762F6000-memory.dmp

Filesize
24KB

Download
memory/212-1-0x00000000013C0000-0x0000000001435000-memory.dmp

Filesize
468KB

Download