c1bec740d32ff293fc343dae42630cb3c199f9d255b575cbe75b603b81b9a4a5

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 22:52

Target

fdd69c75d3db72b7f1f7888432eb4972_JaffaCakes118.dll
Size

1.4MB
MD5

fdd69c75d3db72b7f1f7888432eb4972
SHA1

a34eb058c16e02beaf8665420b6aae0fe027eb2b
SHA256

c1bec740d32ff293fc343dae42630cb3c199f9d255b575cbe75b603b81b9a4a5
SHA512

2ede5386eb79e9818efdc78ec9c4c0fc405e24b898575bc6476f68d83b4bcc6fe2cbeeba3898f612407d140e95f7c51bdd004e04df085652b45ce87e7cf0b9b1
SSDEEP

24576:dOT8BfJSIQCDJ0OXNSQpniag1/rf+pCbIEzW+/m/rF7kchbIEzW+/m/6F7k0:dpOEJ0OXNSCyr007zWYNcV7zWYY0

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 1468	2476	rundll32.exe	85
PID 2476 wrote to memory of 1468	2476	rundll32.exe	85
PID 2476 wrote to memory of 1468	2476	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fdd69c75d3db72b7f1f7888432eb4972_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fdd69c75d3db72b7f1f7888432eb4972_JaffaCakes118.dll,#1
  2⤵
  PID:1468