1880f1f145827f481ea42abd761243555f2e49e53d513d3ec14bd1f10eb69019

Analysis

max time kernel
137s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 01:20

Target

659586125da41c24c158ad584dd96a4b_JaffaCakes118.dll
Size

129KB
MD5

659586125da41c24c158ad584dd96a4b
SHA1

11babbd9dd39379af0a4c1b719e4951766453539
SHA256

1880f1f145827f481ea42abd761243555f2e49e53d513d3ec14bd1f10eb69019
SHA512

2936c5cb9f140400f68e9461cc571473b2cf775e761bfb57b6d7351aeb6bb38abd34d4cbd69a7850b68fb74c031b68049bcecc2ce98ee89102fc51e6eda05027
SSDEEP

3072:7PnCuXUkETUOtVIqzzwIeOozRxOk/2l0ruqofq7aqVHK:DCuXErXjHiRP+QofDq

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 3924	4916	rundll32.exe	83
PID 4916 wrote to memory of 3924	4916	rundll32.exe	83
PID 4916 wrote to memory of 3924	4916	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\659586125da41c24c158ad584dd96a4b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\659586125da41c24c158ad584dd96a4b_JaffaCakes118.dll,#1
  2⤵
  PID:3924

memory/3924-0-0x0000000010000000-0x0000000010033000-memory.dmp

Filesize
204KB

Download
memory/3924-2-0x0000000002890000-0x00000000028A0000-memory.dmp

Filesize
64KB

Download
memory/3924-1-0x0000000002890000-0x00000000028A0000-memory.dmp

Filesize
64KB

Download
memory/3924-3-0x0000000010000000-0x0000000010033000-memory.dmp

Filesize
204KB

Download