23f82034b94d8f2995cb99978c524ad6044ee7cc2f83a7706bfb89e6ce5fe6b8

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 10:26

Target

fa199e5c603b5c8a7c4291c5631ad643_JaffaCakes118.dll
Size

1.1MB
MD5

fa199e5c603b5c8a7c4291c5631ad643
SHA1

a9b10896270a65a327611fbeae0108a9ed073c80
SHA256

23f82034b94d8f2995cb99978c524ad6044ee7cc2f83a7706bfb89e6ce5fe6b8
SHA512

b5be69d919ac6cfb0b9fd40f10ed07676890d6062682f1fe7eee13c2af3103a8b344df74de7aab6caba7962a58ea667697758353d7ff600b83de7d0e43dad647
SSDEEP

24576:sMW5GDGbRcrfOBDi9u+pS0+M3tb0pvaep5Z+8SV:IYDFfOBDi9u/0J3tCieDy

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3356 wrote to memory of 1920	3356	rundll32.exe	83
PID 3356 wrote to memory of 1920	3356	rundll32.exe	83
PID 3356 wrote to memory of 1920	3356	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fa199e5c603b5c8a7c4291c5631ad643_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3356
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fa199e5c603b5c8a7c4291c5631ad643_JaffaCakes118.dll,#1
  2⤵
  PID:1920