11305915ef60762f59e4bb473429e58973bfc33b0459c20bc953ee1d6ea78f0c

Analysis

max time kernel
131s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 16:38

Target

13967e72ae4ba27c9d3209091e9c1d6c_JaffaCakes118.dll
Size

62KB
MD5

13967e72ae4ba27c9d3209091e9c1d6c
SHA1

455a7daa0ee8030aaa478c11f6ef7c0cc92716e6
SHA256

11305915ef60762f59e4bb473429e58973bfc33b0459c20bc953ee1d6ea78f0c
SHA512

671d549724e02df24b2275a78cd34e8ac180e134b6c39e0969e7b7f37119fd4c64358e694aaae5a1eb70818aed3c2441abf2cf928994de63fff4d8ea309b947a
SSDEEP

1536:JI+vFUaVUTyHJfYX00yHPEJjcA8UOcrhF9ImlFDf:C0FeTyHW1YAWWFGSFD

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1836 wrote to memory of 1088	1836	rundll32.exe	84
PID 1836 wrote to memory of 1088	1836	rundll32.exe	84
PID 1836 wrote to memory of 1088	1836	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\13967e72ae4ba27c9d3209091e9c1d6c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1836
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\13967e72ae4ba27c9d3209091e9c1d6c_JaffaCakes118.dll,#1
  2⤵
  PID:1088