535e649935c50909c2698c315b428348fbca2f892d8ad6322de294f2f750839c

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2024, 07:18

Target

5f88edf48f9d8cce5dd257e6956d6c92_JaffaCakes118.dll
Size

160KB
MD5

5f88edf48f9d8cce5dd257e6956d6c92
SHA1

dc085d45bb8f9640f75bd02784e291c4dc205855
SHA256

535e649935c50909c2698c315b428348fbca2f892d8ad6322de294f2f750839c
SHA512

7810519531d64196b0a96c94ec91fcd3270a97267fd651a08ad7c2c82b1f8b08dff89f4977d1b08b4d28a69e60402087d6746eec922bafdd9f61a92d442c4aed
SSDEEP

3072:W71khp8tmF/BEDcc7nhQIhWP+tNuE1Orc1PKkmfMjJFeaH5K:WJtmAFnh2Pf631iqmu

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3688 wrote to memory of 768	3688	rundll32.exe	83
PID 3688 wrote to memory of 768	3688	rundll32.exe	83
PID 3688 wrote to memory of 768	3688	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5f88edf48f9d8cce5dd257e6956d6c92_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3688
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5f88edf48f9d8cce5dd257e6956d6c92_JaffaCakes118.dll,#1
  2⤵
  PID:768

memory/768-0-0x0000000010000000-0x000000001002A000-memory.dmp

Filesize
168KB

Download
memory/768-1-0x0000000010000000-0x000000001002A000-memory.dmp

Filesize
168KB

Download
memory/768-2-0x0000000010000000-0x000000001002A000-memory.dmp

Filesize
168KB

Download