9f890bcf4f6d4e9a499ea6556151dca812c1850794d0890e4cea32c2bd2f587b

Analysis

max time kernel
4s
max time network
8s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08-04-2024 23:20

Target

e8ab028c25ca0320e4321c557e5ab4f3_JaffaCakes118.dll
Size

188KB
MD5

e8ab028c25ca0320e4321c557e5ab4f3
SHA1

84325479318f2babdd9e7d99c120ebb3469b790a
SHA256

9f890bcf4f6d4e9a499ea6556151dca812c1850794d0890e4cea32c2bd2f587b
SHA512

ac623ec478033ef3f9638462b40ddf6476b32de569246a9f4aec171e352c3153fc704b0730d2d5613a142b9897dd0b717e35ec4982d5c7f54dcf40773f319ea6
SSDEEP

3072:nA8JmK7ATVfQeVqNFZa/9KzMXJ6jTFDlAwqWut5KZMzfeAAAoro:nzIqATVfQeV2FZalKq6jtGJWuTmd

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1712 wrote to memory of 3036	1712	rundll32.exe	rundll32.exe
PID 1712 wrote to memory of 3036	1712	rundll32.exe	rundll32.exe
PID 1712 wrote to memory of 3036	1712	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e8ab028c25ca0320e4321c557e5ab4f3_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1712

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e8ab028c25ca0320e4321c557e5ab4f3_JaffaCakes118.dll,#1
2⤵
PID:3036