21083b53e973af12614d43d5c5cacbcb5000373c6a9d2ecdbd01aa2b88318887

Analysis

max time kernel
133s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 04:31

Target
117eff31c74f6b6bd92fb5ca954934b6_JaffaCakes118.dll
Size 1.0MB
Sample240504-e5geasgb74
SHA256 21083b53e973af12614d43d5c5cacbcb5000373c6a9d2ecdbd01aa2b88318887
MD5 117eff31c74f6b6bd92fb5ca954934b6
SHA1 30c1eba571ffece9f54e5eb4010f66d33401d0b7
SHA512 f7bb4874e10b4b5bfa1393cff52723ac4c5c3cd8b30d8eaa8f43ab3ee626adec8566b894e3c2bd03f2e9829cb3129fd3ed34cf182f0dd463bad457bd57481da0
SSDEEP 24576:Hzmw/dCoqtve1GxesJ5H6yTFExWXI8exhBg/VoJgCfObQQjW8Yo4TCXJ7:TD2e1GQNloi+
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 1872	4512	rundll32.exe	84
PID 4512 wrote to memory of 1872	4512	rundll32.exe	84
PID 4512 wrote to memory of 1872	4512	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\117eff31c74f6b6bd92fb5ca954934b6_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\117eff31c74f6b6bd92fb5ca954934b6_JaffaCakes118.dll,#1
  2⤵
  PID:1872