75fc6d04498510f838fd7e459749ba5b6001b0db9ca5aad3610e2fdc8c830f93

Analysis

max time kernel
91s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 13:39

Target

ea1c91ec3e285266e572257ab5bd8149_JaffaCakes118.dll
Size

33KB
MD5

ea1c91ec3e285266e572257ab5bd8149
SHA1

80aa1379bd2f28fc99ca1440cee12cc896a4095c
SHA256

75fc6d04498510f838fd7e459749ba5b6001b0db9ca5aad3610e2fdc8c830f93
SHA512

ab24cb18a58b27d871b67b8ffc3c49fa3f0c4dcdf184d4aca880cb75c2bd47feee7278306610ee6eb7672ebece5bb073120728d7b0cb455dc5f47216c45242d6
SSDEEP

768:GBC39bq5oxE2AdR40kYO2lg7EW1DdgI5hqDMTR5b+X:GBwgAEw0kY87EWddgWk+Rd+X

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 316 wrote to memory of 4804	316	rundll32.exe	86
PID 316 wrote to memory of 4804	316	rundll32.exe	86
PID 316 wrote to memory of 4804	316	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ea1c91ec3e285266e572257ab5bd8149_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:316
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ea1c91ec3e285266e572257ab5bd8149_JaffaCakes118.dll,#1
  2⤵
  PID:4804