8e1235c9d89b045e71bc748e2a3640baa006579e1f9f02bfc1d269c291889cba

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2024, 05:07

Target

f2c117501fddbe4b43835681c8fb7dd2_JaffaCakes118.dll
Size

190KB
MD5

f2c117501fddbe4b43835681c8fb7dd2
SHA1

efb389307c5bc954a2b1c33372a8b7580fefbceb
SHA256

8e1235c9d89b045e71bc748e2a3640baa006579e1f9f02bfc1d269c291889cba
SHA512

009aa5424a2985dd73a06fff0fbb4c39ff924a738bb4e9ba0e14b4f47c1c079ec5ed313c86038a675f2705a8409d755392555acc8164975b674311fc6b30f76c
SSDEEP

3072:V8+ZH3QKakSgZfPiavu7nh4WKwE4trX1LKiM69lgdHXct+Z3lu/s4OnUr:VJgr3AiavcfKf43LBQBXc8k/ROn

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 3208	2368	rundll32.exe	81
PID 2368 wrote to memory of 3208	2368	rundll32.exe	81
PID 2368 wrote to memory of 3208	2368	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f2c117501fddbe4b43835681c8fb7dd2_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f2c117501fddbe4b43835681c8fb7dd2_JaffaCakes118.dll,#1
  2⤵
  PID:3208