79d58f0b5320ffb07e6bf9b96f3731da8cfafb6987011aa6dde84929fb7a18fd

Analysis

max time kernel
142s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2024, 19:40

Target

6120f6cb5d167cbb48282bb397f58398_JaffaCakes118.dll
Size

120KB
MD5

6120f6cb5d167cbb48282bb397f58398
SHA1

ee1eeb37db5fbc192aec00e851b95c6c3e54bc2b
SHA256

79d58f0b5320ffb07e6bf9b96f3731da8cfafb6987011aa6dde84929fb7a18fd
SHA512

868bef1d122fb527e1cf89e728bba1dcd75bbe3562bf82140c45f81b3bd8f4e6ddba599f81b7740f45316683def50cf73a68275cd05cb698c4961c1f2d46bb6f
SSDEEP

3072:glUfK0VUHng81wX50AJdFDnY24yMMo3WcSjvoIofwC:gKffWPyX50A1jY24XBSjro

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3876 wrote to memory of 1504	3876	rundll32.exe	84
PID 3876 wrote to memory of 1504	3876	rundll32.exe	84
PID 3876 wrote to memory of 1504	3876	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6120f6cb5d167cbb48282bb397f58398_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6120f6cb5d167cbb48282bb397f58398_JaffaCakes118.dll,#1
  2⤵
  PID:1504

memory/1504-0-0x0000000000470000-0x000000000047A000-memory.dmp

Filesize
40KB

Download
memory/1504-2-0x0000000010000000-0x0000000010009000-memory.dmp

Filesize
36KB

Download
memory/1504-4-0x0000000000470000-0x000000000047A000-memory.dmp

Filesize
40KB

Download
memory/1504-8-0x0000000000470000-0x000000000047A000-memory.dmp

Filesize
40KB

Download