93d3e0f3a28cf6b91a68b2ad97c89d50f4f7524735c353fd6143a350d10e71d0

Analysis

max time kernel
95s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16/07/2024, 00:55

Target

4c26aee4785d333ac97df700f7e66033_JaffaCakes118.dll
Size

37KB
MD5

4c26aee4785d333ac97df700f7e66033
SHA1

8ec20f214adcfab238c4f068fb1d07bd139768f8
SHA256

93d3e0f3a28cf6b91a68b2ad97c89d50f4f7524735c353fd6143a350d10e71d0
SHA512

2c9ce3f226586a01ee6d07d79f70d8ceee321678a13d7b1891e8895b4ab1566163de10de586e9e433a7adb7b71a24e356cc4feafc2408da03d61e5b66377fd51
SSDEEP

768:af4DeMKAPgXFLEZY4D1VaykZIXZh2EGksChaydOzLA:af4DeMKAPgVWpQIn2EZpOzLA

Score

1^/10

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3116 wrote to memory of 2428	3116	rundll32.exe	83
PID 3116 wrote to memory of 2428	3116	rundll32.exe	83
PID 3116 wrote to memory of 2428	3116	rundll32.exe	83
PID 2428 wrote to memory of 4760	2428	rundll32.exe	86
PID 2428 wrote to memory of 4760	2428	rundll32.exe	86
PID 2428 wrote to memory of 4760	2428	rundll32.exe	86
PID 4760 wrote to memory of 4840	4760	net.exe	88
PID 4760 wrote to memory of 4840	4760	net.exe	88
PID 4760 wrote to memory of 4840	4760	net.exe	88
PID 2428 wrote to memory of 3252	2428	rundll32.exe	90
PID 2428 wrote to memory of 3252	2428	rundll32.exe	90
PID 2428 wrote to memory of 3252	2428	rundll32.exe	90
PID 3252 wrote to memory of 2628	3252	net.exe	92
PID 3252 wrote to memory of 2628	3252	net.exe	92
PID 3252 wrote to memory of 2628	3252	net.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c26aee4785d333ac97df700f7e66033_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3116
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c26aee4785d333ac97df700f7e66033_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Windows\SysWOW64\net.exe
    net stop winss
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4760
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop winss
      4⤵
      PID:4840
- - C:\Windows\SysWOW64\net.exe
    net stop OcHealthMon
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3252
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop OcHealthMon
      4⤵
      PID:2628

memory/2428-0-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/2428-2-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/2428-1-0x0000000002AB0000-0x0000000002AB5000-memory.dmp

Filesize
20KB

Download