fe628b93aa96bebdba80c80efc742c62bdc9a7948e46fbb740177f58bee66695

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 03:47

Target

fbdb2a015fffa3255991b02c050280b1_JaffaCakes118.dll
Size

560KB
MD5

fbdb2a015fffa3255991b02c050280b1
SHA1

6edae220899e6800ccb95e46b84249536e99ef55
SHA256

fe628b93aa96bebdba80c80efc742c62bdc9a7948e46fbb740177f58bee66695
SHA512

128a614f359731b72ef87877a6b0fdea26759a6e2a1c84a138333c08920dd31b07a5951a366190db223152b63ac375b99675b0b6878c1b49ce96fa9022d64dc4
SSDEEP

12288:svbv8DhhNkVXqpoAGCKcZFLzY762EXBSn49W9t/WaceipEXWO:IMhhoXqm8VzFJXMnJ9WLecuJ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 1924	1672	rundll32.exe	86
PID 1672 wrote to memory of 1924	1672	rundll32.exe	86
PID 1672 wrote to memory of 1924	1672	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fbdb2a015fffa3255991b02c050280b1_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fbdb2a015fffa3255991b02c050280b1_JaffaCakes118.dll,#1
  2⤵
  PID:1924