21083b53e973af12614d43d5c5cacbcb5000373c6a9d2ecdbd01aa2b88318887

Analysis

max time kernel
133s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04-05-2024 04:31

Target

117eff31c74f6b6bd92fb5ca954934b6_JaffaCakes118.dll
Size

1.0MB
MD5

117eff31c74f6b6bd92fb5ca954934b6
SHA1

30c1eba571ffece9f54e5eb4010f66d33401d0b7
SHA256

21083b53e973af12614d43d5c5cacbcb5000373c6a9d2ecdbd01aa2b88318887
SHA512

f7bb4874e10b4b5bfa1393cff52723ac4c5c3cd8b30d8eaa8f43ab3ee626adec8566b894e3c2bd03f2e9829cb3129fd3ed34cf182f0dd463bad457bd57481da0
SSDEEP

24576:Hzmw/dCoqtve1GxesJ5H6yTFExWXI8exhBg/VoJgCfObQQjW8Yo4TCXJ7:TD2e1GQNloi+

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4512 wrote to memory of 1872	4512	rundll32.exe	rundll32.exe
PID 4512 wrote to memory of 1872	4512	rundll32.exe	rundll32.exe
PID 4512 wrote to memory of 1872	4512	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\117eff31c74f6b6bd92fb5ca954934b6_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4512

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\117eff31c74f6b6bd92fb5ca954934b6_JaffaCakes118.dll,#1
2⤵
PID:1872