911ec2f7949e3609ad4b61ecb588c951e1cd023fb630a8c1dc5b603253992f04

Analysis

max time kernel
66s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 17:14

Target

01430e10795c3d2d5327c411b745b13f_JaffaCakes118.dll
Size

63KB
MD5

01430e10795c3d2d5327c411b745b13f
SHA1

54ed9eaa8099c839c7c449c021f00a680b1570f9
SHA256

911ec2f7949e3609ad4b61ecb588c951e1cd023fb630a8c1dc5b603253992f04
SHA512

13ea69ac8d18007ba159f8f3a9c3255e0ba711f0d4966c5b73eaface9a29405d2e8786f9d684cf6b447939c49fdd3c5e0df10344e26ac2459cc3eef6fa3adcff
SSDEEP

1536:H/+lis8usYy0G9LU16QyF1zwsK9qSwhvuvHxYpyzPrMzF1:Glis85YlMQe8p9JIW/GSPrMr

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 4776	540	rundll32.exe	85
PID 540 wrote to memory of 4776	540	rundll32.exe	85
PID 540 wrote to memory of 4776	540	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\01430e10795c3d2d5327c411b745b13f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:540
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\01430e10795c3d2d5327c411b745b13f_JaffaCakes118.dll,#1
  2⤵
  PID:4776