5ab8dfdf1ca612a6b50fbad35481dd85af10fe3cd25b281babb3e01f4c35957d

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 06:51

Target

f9be5872645e4171da59f49d47f26ee6_JaffaCakes118.dll
Size

25KB
MD5

f9be5872645e4171da59f49d47f26ee6
SHA1

a2739f91b8b646fc345f4c6a5303b2ede4bc0a3b
SHA256

5ab8dfdf1ca612a6b50fbad35481dd85af10fe3cd25b281babb3e01f4c35957d
SHA512

384b2feabceeebbe721331ef82793edf9e966e78f384ce8e07fe1b132be93861a999de5ef7053f77bf6416c83580b4cc09be4c94970d7dc1f71ff861c72f1857
SSDEEP

384:R0jLX4ZIIBHG7/+BPQUBGf2NCEFqMOrfG97uBBQARQk6HXORVlBK:R0jLqye5EEFqMwfdBBQARQk63ORVl

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3540 wrote to memory of 4788	3540	rundll32.exe	85
PID 3540 wrote to memory of 4788	3540	rundll32.exe	85
PID 3540 wrote to memory of 4788	3540	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f9be5872645e4171da59f49d47f26ee6_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3540
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f9be5872645e4171da59f49d47f26ee6_JaffaCakes118.dll,#1
  2⤵
  PID:4788