05e911dfc0f644b9bf90f0ca6686784fa4ed9d6f6db119129408f99761df246f

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 15:38

Target

fa9e845afd7952aba059e766b0c61bbd_JaffaCakes118.dll
Size

650KB
MD5

fa9e845afd7952aba059e766b0c61bbd
SHA1

8b21b536f489134ada957809e09589741fde5f9d
SHA256

05e911dfc0f644b9bf90f0ca6686784fa4ed9d6f6db119129408f99761df246f
SHA512

d96adeb16cb709d50414a952ab78a098c2753dd45897cfee5d9c107a4cd66fe7bbc1f8095a7b6f832fe3bd177868f0ebffeaf88e5e55da17da38f2ea43c1efdd
SSDEEP

12288:bCo9lUzOvdYImmWE2h/eWtBvmfDRUvqWECYQMFNun8l3VcQSc:h9l5mmWEG/eWPvmfDRUvwNQMFNu8l3Vx

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4184 wrote to memory of 5072	4184	rundll32.exe	83
PID 4184 wrote to memory of 5072	4184	rundll32.exe	83
PID 4184 wrote to memory of 5072	4184	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fa9e845afd7952aba059e766b0c61bbd_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4184
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fa9e845afd7952aba059e766b0c61bbd_JaffaCakes118.dll,#1
  2⤵
  PID:5072