5ec3ae249621e50a423e933bcef756135bc1cb555679e6d3a296d216453558f1

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/04/2024, 16:37

Target

ede089f7a5ecf3709949c0295668fa37_JaffaCakes118.dll
Size

842KB
MD5

ede089f7a5ecf3709949c0295668fa37
SHA1

b8dc4e5e208958a5df1063893935848eadecd160
SHA256

5ec3ae249621e50a423e933bcef756135bc1cb555679e6d3a296d216453558f1
SHA512

d14a50607e03a5d75bf527e0e69fa8969aa4bb48fe8ffa38861115d2735958bd6e58384fef8e03f6bfaa5d3266949da3679a4896231b3ef46fd1df343d3d626c
SSDEEP

12288:68n1eFPnpNjiSgS4iM7qfIYljluMIv52YOwR4qNmgR7pnq:gImK

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 1856	1056	rundll32.exe	84
PID 1056 wrote to memory of 1856	1056	rundll32.exe	84
PID 1056 wrote to memory of 1856	1056	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ede089f7a5ecf3709949c0295668fa37_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ede089f7a5ecf3709949c0295668fa37_JaffaCakes118.dll,#1
  2⤵
  PID:1856