7b5614d46197678ff8b42d98db5bd308aa91ca62b71628008544041baea825b5

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19-07-2024 04:17

Target

5a6e5207ba543c99a9eac8db08d12494_JaffaCakes118.dll
Size

130KB
MD5

5a6e5207ba543c99a9eac8db08d12494
SHA1

49dc65ad3fb57f4273f1688625a1a4fc16a5d03f
SHA256

7b5614d46197678ff8b42d98db5bd308aa91ca62b71628008544041baea825b5
SHA512

5bdd2e7b7c32527421f07e2273c40e221ef4523062d88f019d5d7e8a369d29c3a225d1ffa797f50aa4f728beca847f5c559c4c264d93a815930215be7d180884
SSDEEP

3072:dcIJuSKBY1tiXJhyUIP4WX40aQvmSX1oDHWLKEMhr:dcIJuSEYWXJhyPP4WX42FobnEM

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 3076	1292	rundll32.exe	84
PID 1292 wrote to memory of 3076	1292	rundll32.exe	84
PID 1292 wrote to memory of 3076	1292	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a6e5207ba543c99a9eac8db08d12494_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a6e5207ba543c99a9eac8db08d12494_JaffaCakes118.dll,#1
  2⤵
  PID:3076

memory/3076-0-0x0000000010000000-0x0000000010033000-memory.dmp

Filesize
204KB

Download
memory/3076-2-0x0000000000890000-0x00000000008A0000-memory.dmp

Filesize
64KB

Download
memory/3076-1-0x0000000000890000-0x00000000008A0000-memory.dmp

Filesize
64KB

Download
memory/3076-3-0x0000000010000000-0x0000000010033000-memory.dmp

Filesize
204KB

Download