11ca228dc681ac9218a70a1934835f19c10d48226ac67e7ae88f7c435c8533d0

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28/04/2024, 12:12

Target

052a201bc961a4bdbdd9b24ba894bec0_JaffaCakes118.dll
Size

3.0MB
MD5

052a201bc961a4bdbdd9b24ba894bec0
SHA1

4b881e5c36662fa4b4dd38e7339b8cf662356546
SHA256

11ca228dc681ac9218a70a1934835f19c10d48226ac67e7ae88f7c435c8533d0
SHA512

8626fce645ed4f1de566968b89352348ba74099e25601add60a17aa27a84e7274c8b4eb5175f3f9c2702c34417a39c25cf366e601bb782772f4e05127bc80c29
SSDEEP

49152:gbcr6levCyhCTCjyLBxMdF3V50T6mMGFuImn50VENZ4Y7TUxIj:acr6gvCyxyL+YuB50VENZhv

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 2180	1192	rundll32.exe	83
PID 1192 wrote to memory of 2180	1192	rundll32.exe	83
PID 1192 wrote to memory of 2180	1192	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\052a201bc961a4bdbdd9b24ba894bec0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\052a201bc961a4bdbdd9b24ba894bec0_JaffaCakes118.dll,#1
  2⤵
  PID:2180