985f2b2a81e40e107bb25f026274d44f2bf123fd1ca142051f1c44f921c2a5e4

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-03-2024 21:53

Target

110cf4b4140ca6cddf45392ce7f2db65_JaffaCakes118.dll
Size

1.0MB
MD5

110cf4b4140ca6cddf45392ce7f2db65
SHA1

a8e65203c0a0d69d379d7de58ae32bf72b359efa
SHA256

985f2b2a81e40e107bb25f026274d44f2bf123fd1ca142051f1c44f921c2a5e4
SHA512

eafc4ddc2e1f47a7ddbaf4d86e155a78dd139a7469651d09e95305c3815edecd28a3e3720c61816fe52dfc709903ea2849e3622af40130cdc6181ef9624f1458
SSDEEP

24576:LU0QINf+2jAnRmoXPADkRKgiBSFHS3oaJQV7zBd4YeQm/09rA:LU0QIx+pnrXPADkRKgvHxDpz0YeQWor

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4448 wrote to memory of 116	4448	rundll32.exe	rundll32.exe
PID 4448 wrote to memory of 116	4448	rundll32.exe	rundll32.exe
PID 4448 wrote to memory of 116	4448	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\110cf4b4140ca6cddf45392ce7f2db65_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4448

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\110cf4b4140ca6cddf45392ce7f2db65_JaffaCakes118.dll,#1
2⤵
PID:116