4b8572acd3dc4ea84d33b59857ddb91d28689bfad362cc4c4afb2cfc4a58b020

Analysis

max time kernel
150s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 23:56

Target

fb73f0e206a03aa8852b1b495dc2b6f7_JaffaCakes118.dll
Size

54KB
MD5

fb73f0e206a03aa8852b1b495dc2b6f7
SHA1

abb47ce971875c34fbca03ce1b390122c9fe4b58
SHA256

4b8572acd3dc4ea84d33b59857ddb91d28689bfad362cc4c4afb2cfc4a58b020
SHA512

4f3404b480f26b2f266a6d5e5ba3237972f16ac00112d429e5b857f1184a52dffaf08db384bb86863564ab2fe96bfe544b2875b55bbf02f489df0549e160340c
SSDEEP

768:StA0owz57m4vOyECCT4/D/HctbaVQBWq7kMFmB/u3OzLTrU7yA9/SYIOcVnToIf1:StAazFvOyEC//7AQYIOcVnToIfSg

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 3256	2824	rundll32.exe	86
PID 2824 wrote to memory of 3256	2824	rundll32.exe	86
PID 2824 wrote to memory of 3256	2824	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb73f0e206a03aa8852b1b495dc2b6f7_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb73f0e206a03aa8852b1b495dc2b6f7_JaffaCakes118.dll,#1
  2⤵
  PID:3256