725a0a3a3d68dd20c311130cbdbfe05da7fc5677c48a77383e6228412c5c6ddf

Analysis

max time kernel
97s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/04/2024, 12:57

Target
e297f9574f1829be82ba9181ccb39fdf_JaffaCakes118.dll
Size 79KB
Sample240406-p7dfjabd76
SHA256 725a0a3a3d68dd20c311130cbdbfe05da7fc5677c48a77383e6228412c5c6ddf
MD5 e297f9574f1829be82ba9181ccb39fdf
SHA1 bdf80988d0de4a02c5d4cf74abf54ea3ab723098
SHA512 bc44f70630bb882ebf4705bb3a830d633dbf00c7be7a656f158a5ba23683fc93ebe8c34e1ebe47a52bb045885520b6a2b2ea2e7ca2028c1b6635c659e134ed91
SSDEEP 768:UbTUltJhq7rgHAoBUzszDBcY8wgxRyQf/XgpadfXcO6lT8GxBJ8V0BPrjPgxKA5B:+QqZzsqYobwpKcMqrbgxKyIItc5NkNp
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 4668	1124	rundll32.exe	85
PID 1124 wrote to memory of 4668	1124	rundll32.exe	85
PID 1124 wrote to memory of 4668	1124	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e297f9574f1829be82ba9181ccb39fdf_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e297f9574f1829be82ba9181ccb39fdf_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4668