1643f4225622c610814de332b42270926f4776dc864d9349923917f4e92ac8cb

Analysis

max time kernel
128s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 22:45

Target

14d0429a230198f77bd856966aaddae3_JaffaCakes118.dll
Size

192KB
MD5

14d0429a230198f77bd856966aaddae3
SHA1

b88862f1a306cea0c6f8211dd1b267d6e4432183
SHA256

1643f4225622c610814de332b42270926f4776dc864d9349923917f4e92ac8cb
SHA512

021e0770496092075ab25604f4950d9678a655fd1e121841341b0aa5da5c5f5ae6efceddc0a4ddb9bd0b1ceda1ad646195d690a9d4d64b43ef2b00f8c7fcf189
SSDEEP

3072:3NbpOnPsGqQTruHLD7RcQxKrrdNU0VAtrOpOOWxOv4Kn7qbjx7T/Hrm38:3NbqaLD7RcukVAtSQOWcgWqbV77Lm38

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4040 wrote to memory of 2868	4040	rundll32.exe	85
PID 4040 wrote to memory of 2868	4040	rundll32.exe	85
PID 4040 wrote to memory of 2868	4040	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\14d0429a230198f77bd856966aaddae3_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\14d0429a230198f77bd856966aaddae3_JaffaCakes118.dll,#1
  2⤵
  PID:2868