bd2db5c0ebd0db49e6e6142861164008a7b899af0e484ef55da49848d887978b

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 06:43

Target

f9ba605c71b3dacacdd4cfc2d561721c_JaffaCakes118.dll
Size

6KB
MD5

f9ba605c71b3dacacdd4cfc2d561721c
SHA1

ec504557de1705b2c3b9e6bac1132c6150cda185
SHA256

bd2db5c0ebd0db49e6e6142861164008a7b899af0e484ef55da49848d887978b
SHA512

ff4f2bf4db6a29392ed9fc93e092d297432d19f3a009e6d207616588f4d5d19727e9a86be7c8784ad296ae1896fd716c093a4a40e5a2e03684fe47db91bd634a
SSDEEP

48:6AA35YVOQDV8FszwydlAYsLFV3G0wB+BDq9J5S2:0QDV8FscMjsLFV3IB+FqX5S2

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2812 wrote to memory of 1688	2812	rundll32.exe	83
PID 2812 wrote to memory of 1688	2812	rundll32.exe	83
PID 2812 wrote to memory of 1688	2812	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f9ba605c71b3dacacdd4cfc2d561721c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f9ba605c71b3dacacdd4cfc2d561721c_JaffaCakes118.dll,#1
  2⤵
  PID:1688