108a9282e92ded79e7b1fa413e484fc5054c799476dda651d5e7370eb318f21e

Analysis

max time kernel
129s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 04:53

Target

118a833e8dd4c46ba667a3bff2640a12_JaffaCakes118.dll
Size

71KB
MD5

118a833e8dd4c46ba667a3bff2640a12
SHA1

0fcb468a80ebc6f38238adc7d02bee3b989f4d86
SHA256

108a9282e92ded79e7b1fa413e484fc5054c799476dda651d5e7370eb318f21e
SHA512

ff45df3b4a276eb8ba43f44c05e2d6f44edf4bd003cd427b195b54218541edc677a23567af424f350f6c7430489f333e130ca1ccf5702cd104d43d18f8c43599
SSDEEP

1536:lksmsapPV5kBFfHhUCEZoYsRfOOdwGcVbKY5ERHAps6aFwqZ:msmsaprkBFBUCbDsOd1qbKY5Ov9Z

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 1564	2768	rundll32.exe	84
PID 2768 wrote to memory of 1564	2768	rundll32.exe	84
PID 2768 wrote to memory of 1564	2768	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\118a833e8dd4c46ba667a3bff2640a12_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\118a833e8dd4c46ba667a3bff2640a12_JaffaCakes118.dll,#1
  2⤵
  PID:1564