219efc397b02e53a4c7f8d805553075da9aaaec438e2e7f8eec6929d2d752b2b

Analysis

max time kernel
92s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02-05-2024 01:19

Target

0d16629243610d8605c2c1fcfebf74d4_JaffaCakes118.dll
Size

840KB
MD5

0d16629243610d8605c2c1fcfebf74d4
SHA1

4a47022c63dbccce1dcf0138c96fb6257c2fad57
SHA256

219efc397b02e53a4c7f8d805553075da9aaaec438e2e7f8eec6929d2d752b2b
SHA512

0d092780f90d9f5c1828d389c816fa0e01fefc1da5e736a9d454faaf3b6b92066395f96df6ee345faa492aa9fd34118aac1145889c520affda01492069158895
SSDEEP

12288:Za2rlp6vp+8v2Bc1e8GAERqFmNqVQNGq0HvkufZ90+sD1bSLVtRsCy:ZaaSp+Y2Bc1eRAETNqVQR0H8eZ3Yb6

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3776 wrote to memory of 1612	3776	rundll32.exe	81
PID 3776 wrote to memory of 1612	3776	rundll32.exe	81
PID 3776 wrote to memory of 1612	3776	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d16629243610d8605c2c1fcfebf74d4_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3776
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d16629243610d8605c2c1fcfebf74d4_JaffaCakes118.dll,#1
  2⤵
  PID:1612