22643418f175180506d373c66e6859395fef05d1f1b0a63b03b4e4ff9ce74078

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
29/04/2024, 03:42

Target

06bdf5dd0cc5e6dd939571b64c6444b9_JaffaCakes118.dll
Size

500KB
MD5

06bdf5dd0cc5e6dd939571b64c6444b9
SHA1

deb45b2e31aa9772f760f19eb804cdeda7502ab0
SHA256

22643418f175180506d373c66e6859395fef05d1f1b0a63b03b4e4ff9ce74078
SHA512

e68b0229ecf5734fe67f9c0e24c2a77c50885bc51cf27466ae01f7f6663f6c5c1b34d8e617398b426cb03c4ccf02e8b2a311687b509fd912a96104eecf29b802
SSDEEP

12288:ij218pq/KbadZ2qi7qeBU+F3+JRSACrJItBatRuNV:iOKWdMBF8e6FD

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 4136	1408	rundll32.exe	84
PID 1408 wrote to memory of 4136	1408	rundll32.exe	84
PID 1408 wrote to memory of 4136	1408	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\06bdf5dd0cc5e6dd939571b64c6444b9_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\06bdf5dd0cc5e6dd939571b64c6444b9_JaffaCakes118.dll,#1
  2⤵
  PID:4136