03da77718084b6f90a043e24d0a52563aa501e8bfada8e478ede1a21add94475

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 19:08

Target

faf9d59033542a1501e41cd5769f17d3_JaffaCakes118.dll
Size

6KB
MD5

faf9d59033542a1501e41cd5769f17d3
SHA1

909267c0c25caa12c602acc603c3d04ef6e32436
SHA256

03da77718084b6f90a043e24d0a52563aa501e8bfada8e478ede1a21add94475
SHA512

d0b5aab1f7155a903af220e8e71f8eb421a32748226615b25d6cec1b3d9efe7add2ef6a79d2d9f352bf0de76bdb62905108ce8420b8bd1b4d19bcd9b76ddde85
SSDEEP

48:6EQt5YVOSVVEPy+wEMmqiHNpU1007B+BDq9J5SV3DY:CSVVEPozmB7CB+FqX5S1D

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 4164	4868	rundll32.exe	85
PID 4868 wrote to memory of 4164	4868	rundll32.exe	85
PID 4868 wrote to memory of 4164	4868	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\faf9d59033542a1501e41cd5769f17d3_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\faf9d59033542a1501e41cd5769f17d3_JaffaCakes118.dll,#1
  2⤵
  PID:4164