1770058721fba49c50b84fe16fd5fce0eaab587a96c56332f4496e8c07183ecc

Analysis

max time kernel
136s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 06:32

Target

667d3bc93442e2e5b78ba8bfd431722b_JaffaCakes118.dll
Size

43KB
MD5

667d3bc93442e2e5b78ba8bfd431722b
SHA1

17df43c2ddf1eadef717a8c552ddfe8cc00f46b6
SHA256

1770058721fba49c50b84fe16fd5fce0eaab587a96c56332f4496e8c07183ecc
SHA512

039d5190d7300f85c91626ee1ba73faabb413f867e17bbe816924b59ffcbd44cf629394dc134a0eb993eea7c7cf7679edd721383361ced87eaf9b9b1a2a581f7
SSDEEP

768:HprfssORClkPNpxinvzxrOP2o6+gRGE/0LRakM7D1GoIvoiH52IamE/9JHUl0:HhgRCa3xibxrOP2+cGz4kM7JGoIvh520

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 3388	2776	rundll32.exe	84
PID 2776 wrote to memory of 3388	2776	rundll32.exe	84
PID 2776 wrote to memory of 3388	2776	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\667d3bc93442e2e5b78ba8bfd431722b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\667d3bc93442e2e5b78ba8bfd431722b_JaffaCakes118.dll,#1
  2⤵
  PID:3388

memory/3388-2-0x0000000001520000-0x0000000001529000-memory.dmp

Filesize
36KB

Download
memory/3388-1-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download
memory/3388-4-0x0000000010001000-0x0000000010008000-memory.dmp

Filesize
28KB

Download
memory/3388-3-0x0000000001560000-0x0000000001561000-memory.dmp

Filesize
4KB

Download
memory/3388-5-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download