13bc1fee1b0ce2f84025444bc1c164e0c562deba06bab419b408bc067cb4822a

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2024, 09:32

Target

170c397e976a9eeb97b02a390a0f5fdc_JaffaCakes118.dll
Size

192KB
MD5

170c397e976a9eeb97b02a390a0f5fdc
SHA1

dc2e75ec2816fbec12b57298e6696540f2d7a7d7
SHA256

13bc1fee1b0ce2f84025444bc1c164e0c562deba06bab419b408bc067cb4822a
SHA512

9ece4b29392d6f1586445389e27a40cb2ad694bc044f1e2a7bd1a11a8385736a652ae804b2569c6c7bc9804ec75a98f885c81eb820f6dd1367f186c0c5c60064
SSDEEP

3072:ENbpOnPsGqQTruHLD7RcQxKrrdNU0VAtrOpOOWxOv4Kn7qbjx7T/Hrms:ENbqaLD7RcukVAtSQOWcgWqbV77Lms

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 988 wrote to memory of 320	988	rundll32.exe	84
PID 988 wrote to memory of 320	988	rundll32.exe	84
PID 988 wrote to memory of 320	988	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\170c397e976a9eeb97b02a390a0f5fdc_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\170c397e976a9eeb97b02a390a0f5fdc_JaffaCakes118.dll,#1
  2⤵
  PID:320