4f693aaeebac5344c4e803badd481634b61e82bb52538855dac8eb139c895a78

Analysis

max time kernel
83s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2024, 11:19

Target

f361298f7dac30bd348d520ecc4cd661_JaffaCakes118.dll
Size

110KB
MD5

f361298f7dac30bd348d520ecc4cd661
SHA1

b535f11c01fcdce94d17bfc28d01d86e87e7c2c7
SHA256

4f693aaeebac5344c4e803badd481634b61e82bb52538855dac8eb139c895a78
SHA512

9ed06a2a16a618c98a12a975ac653362802145bc1b68dd4103e5b7180441a122fe359d939fac4c8b02163a2613a4ee78f43dd5b21b88621910f592935f3d29de
SSDEEP

3072:uVHc+VHcn/5VCgBs2+VWLJN/oD35oZjesrDZmavbwyQ9U:/5VCgBeVi09SKsrDZmkbxwU

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 1472	4824	rundll32.exe	86
PID 4824 wrote to memory of 1472	4824	rundll32.exe	86
PID 4824 wrote to memory of 1472	4824	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f361298f7dac30bd348d520ecc4cd661_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f361298f7dac30bd348d520ecc4cd661_JaffaCakes118.dll,#1
  2⤵
  PID:1472