5f055b6b565c0609fe6601db897940ad85c3c469dad6470c7e7b54b90b757a21

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2024, 23:02

Target

f4851a9b321c5cc06594246c43006c2c_JaffaCakes118.dll
Size

73KB
MD5

f4851a9b321c5cc06594246c43006c2c
SHA1

c7e9b2a49f12fb86edd51bd41f4fdb1ff525843b
SHA256

5f055b6b565c0609fe6601db897940ad85c3c469dad6470c7e7b54b90b757a21
SHA512

8619560c1bd2cb5033847a0ae92809fbaa86d658a3176814abd7bc47902cf86629eb42fe1e7c12ab05b94c5887b86f74ce805502136f678316d37b6737fae3af
SSDEEP

1536:hO0s6t9laAGclKen/jFnToIfHTRzr5JBAZeiFp0zA+V/R8:c0s6tien/jtTBfHTRzr5JBAZeiP0Z

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 3884	4648	rundll32.exe	82
PID 4648 wrote to memory of 3884	4648	rundll32.exe	82
PID 4648 wrote to memory of 3884	4648	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f4851a9b321c5cc06594246c43006c2c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f4851a9b321c5cc06594246c43006c2c_JaffaCakes118.dll,#1
  2⤵
  PID:3884