8306711bb36c72cb15d3be5b1469b1c72dd732a100584551794cb5131c398549

Analysis

max time kernel
93s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16-04-2024 05:20

Target

f2c61286d529d35bd0c7ccbe75279d64_JaffaCakes118.dll
Size

56KB
MD5

f2c61286d529d35bd0c7ccbe75279d64
SHA1

7201bb9f2de94abe99d0a68ad30d6eb127a3ad0a
SHA256

8306711bb36c72cb15d3be5b1469b1c72dd732a100584551794cb5131c398549
SHA512

eae09575955f09355e3f4a302cd2a119adecffa117f6b0b055b8752a61b4f61a20133ad4b00208a901f89c740fa07819becb967022f7ea18791341bd6ac46869
SSDEEP

1536:Vpuynwff6TmCDltPUliHLBSIbeCXiQy6:VpuynGqmCfP/dzbeUiQ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 4088	1996	rundll32.exe	86
PID 1996 wrote to memory of 4088	1996	rundll32.exe	86
PID 1996 wrote to memory of 4088	1996	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f2c61286d529d35bd0c7ccbe75279d64_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f2c61286d529d35bd0c7ccbe75279d64_JaffaCakes118.dll,#1
  2⤵
  PID:4088