b4facc08c669ba256e9750ea3e1639ebffbb2dbf74f2987fe508a34392480d14

Analysis

max time kernel
136s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2024, 03:50

Target

15d93682e466b60ea2df7b0bec372899_JaffaCakes118.dll
Size

192KB
MD5

15d93682e466b60ea2df7b0bec372899
SHA1

94a1d096ecfff4036bbf3e99efc4fe64eaf8eecb
SHA256

b4facc08c669ba256e9750ea3e1639ebffbb2dbf74f2987fe508a34392480d14
SHA512

0517825cdbfbaad1b838ab5c60eaad9af22b03608d482a120a7b09cd08f152f750e447ce6eb94a4d9948d4d6b53cadfafb6abf0a40dee9d48bddf30ae92eb1ec
SSDEEP

3072:VNbpOnPsGqQTruHLD7RcQxKrrdNU0VAtrOpOOWxOv4Kn7qbjx7T/HrmM:VNbqaLD7RcukVAtSQOWcgWqbV77LmM

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 3124	4848	rundll32.exe	83
PID 4848 wrote to memory of 3124	4848	rundll32.exe	83
PID 4848 wrote to memory of 3124	4848	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\15d93682e466b60ea2df7b0bec372899_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\15d93682e466b60ea2df7b0bec372899_JaffaCakes118.dll,#1
  2⤵
  PID:3124