5a4993b1fe3a21d2509bd2defa8443378abc15e17513b4cef271d6bef54d44fb

Analysis

max time kernel
140s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2024, 03:42

Target

0d64aacc74baa079673123dd01b8afde_JaffaCakes118.dll
Size

136KB
MD5

0d64aacc74baa079673123dd01b8afde
SHA1

ddfef4a957c87fc1b7d27573bd73bd3968575a17
SHA256

5a4993b1fe3a21d2509bd2defa8443378abc15e17513b4cef271d6bef54d44fb
SHA512

8edcddc6946aa0f5de6b5a23f2c7873c1613642a928f093089a35b7bae1123c313101de873f7b27538dd6f0875af7e74fee3ea39c97f71d8929daf04a7afe9c9
SSDEEP

3072:WDnLChlbokIc4jByuwHLHYT2OXSxoVGayJlNr:6ChlbokUBypHYT2OCWHSr

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3608 wrote to memory of 2960	3608	rundll32.exe	84
PID 3608 wrote to memory of 2960	3608	rundll32.exe	84
PID 3608 wrote to memory of 2960	3608	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d64aacc74baa079673123dd01b8afde_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3608
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d64aacc74baa079673123dd01b8afde_JaffaCakes118.dll,#1
  2⤵
  PID:2960