c91f6ee0201ce45297543c6f0644b08ca906b11c362812ca710b8847539c461e

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 12:59

Target

63452f855c7dec39b7487ee56a429eb6_JaffaCakes118.dll
Size

370KB
MD5

63452f855c7dec39b7487ee56a429eb6
SHA1

3dc9ba0bd283142da274d6702eefc6d2783b43fa
SHA256

c91f6ee0201ce45297543c6f0644b08ca906b11c362812ca710b8847539c461e
SHA512

72f48e624705c3119a620ab1299f2b906668587af56e2c4481e08ae9ef734d26195a8a895acc572696116e2781c57b47e1e6134d6e59fb143992c8060e24d4c4
SSDEEP

6144:qOgw2HoFwLKDzjaV2AQQxrsvG6h4eyjGYlByuVO050dvlH:qbwsY9xeeGByuVnOd9H

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3432 wrote to memory of 4636	3432	rundll32.exe	84
PID 3432 wrote to memory of 4636	3432	rundll32.exe	84
PID 3432 wrote to memory of 4636	3432	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\63452f855c7dec39b7487ee56a429eb6_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3432
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\63452f855c7dec39b7487ee56a429eb6_JaffaCakes118.dll,#1
  2⤵
  PID:4636

memory/4636-0-0x0000000002370000-0x0000000002470000-memory.dmp

Filesize
1024KB

Download
memory/4636-1-0x0000000010000000-0x0000000010060000-memory.dmp

Filesize
384KB

Download