05e12fd7ee74a7e30a77adc5a2e4cd32a9bfadd57abf51bf555283b34ddf1650

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/04/2024, 15:52

Target

d80d6a251a74419a3de10872d3107252_JaffaCakes118.dll
Size

6.0MB
MD5

d80d6a251a74419a3de10872d3107252
SHA1

f0673f72d8eb61aca41b714eb8f83c2f011ad901
SHA256

05e12fd7ee74a7e30a77adc5a2e4cd32a9bfadd57abf51bf555283b34ddf1650
SHA512

50d266b33660ec5f0cd822bb88fe9b7286f08b5668ccf7a24be7b864d3d8472ad3277fab8aa961178bb18e76ab48c6643c0181e51a1f18ad7ea38b7b31d88dd1
SSDEEP

98304:8566l2u45UNYFrkvz29kdJWx566l2u45UNYFrkvz29kdJWg566l2u45UNYFrkvz2:06w2u45UNSwvz1JWb6w2u45UNSwvz1JM

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4220 wrote to memory of 4736	4220	rundll32.exe	85
PID 4220 wrote to memory of 4736	4220	rundll32.exe	85
PID 4220 wrote to memory of 4736	4220	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d80d6a251a74419a3de10872d3107252_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d80d6a251a74419a3de10872d3107252_JaffaCakes118.dll,#1
  2⤵
  PID:4736