5659b0d202eee21c1f95e9ed74c0a6362b04796849c07e3c07c260002851119c

Analysis

max time kernel
135s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22-07-2024 22:12

Target

64fed06390a8a4ec2d87f06b30efae05_JaffaCakes118.dll
Size

1.1MB
MD5

64fed06390a8a4ec2d87f06b30efae05
SHA1

6a13bb6b5098b75520047bfae661f72b667e409a
SHA256

5659b0d202eee21c1f95e9ed74c0a6362b04796849c07e3c07c260002851119c
SHA512

923c764ed3da031b6a953f13f06838e98ae3d374b68d332ad69deb4de2819d8ef09a55b3508b551932b9c81b484e8380b70f7887abe4687ebb537fef9a546542
SSDEEP

24576:YNwY9kjEHdtqg8kCO3mkzRs++20WNEdkpBUHpb:YNB6jMdtbPeN

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2404	1732	rundll32.exe	85
PID 1732 wrote to memory of 2404	1732	rundll32.exe	85
PID 1732 wrote to memory of 2404	1732	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\64fed06390a8a4ec2d87f06b30efae05_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\64fed06390a8a4ec2d87f06b30efae05_JaffaCakes118.dll,#1
  2⤵
  PID:2404

memory/2404-0-0x000000006DD30000-0x000000006DE59000-memory.dmp

Filesize
1.2MB

Download
memory/2404-1-0x000000006DD30000-0x000000006DE59000-memory.dmp

Filesize
1.2MB

Download