acd227350dea6b1d35852d467f7e5de53bab38f53e15c61151f897d6c6bdc6c9

Analysis

max time kernel
66s
max time network
49s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
01/05/2024, 05:05

Target

0b1dab2feb114786f573a915c70eeaf5_JaffaCakes118.dll
Size

80KB
MD5

0b1dab2feb114786f573a915c70eeaf5
SHA1

3bba9ca3944a5c37ef1f97b8faee430aefebf55d
SHA256

acd227350dea6b1d35852d467f7e5de53bab38f53e15c61151f897d6c6bdc6c9
SHA512

d1f93208a3af6b169c4164a577c3a6864ccb7349d02fd9a8cfbbd7d627058920f20cfe8ba6ed6347cf64722f0d11beeae09ccf562da53308d5c9c4b8c98277e7
SSDEEP

1536:WrRQtfuQCsB9wSuiRvxjIWca6a4E18aNEmUrFR5KEpREzV+wmieRi5W8EBaRzE:ykm+GdiRZjIM6aL8axIxKETK+wKiEaNE

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 216 wrote to memory of 884	216	rundll32.exe	85
PID 216 wrote to memory of 884	216	rundll32.exe	85
PID 216 wrote to memory of 884	216	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0b1dab2feb114786f573a915c70eeaf5_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:216
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0b1dab2feb114786f573a915c70eeaf5_JaffaCakes118.dll,#1
  2⤵
  PID:884