1195e16b8f55b529ffad83b85190f3059b4c070e2f460269e4b368cbf8fe265e

Analysis

max time kernel
137s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
05-05-2024 15:57

Target

186037ec84f11a9bb0eef72bc7c30408_JaffaCakes118.dll
Size

1.0MB
MD5

186037ec84f11a9bb0eef72bc7c30408
SHA1

891e419f077e954d6e871c1c3f31fcd329347153
SHA256

1195e16b8f55b529ffad83b85190f3059b4c070e2f460269e4b368cbf8fe265e
SHA512

09c673800884cae0646228f3080e761b1ed8194f454e256e9a9f250b868df430016e8faef57a8abdba6a72dd38ba19272d4156dcdf45ee94c2bc2bd0f5b63eda
SSDEEP

24576:LwrdHxPHn+C9wIQw6vWZA2u6wvYk8PY9/Jg/l/YH:LwrDeO3M2uMk8Pug/2H

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4904 wrote to memory of 708	4904	rundll32.exe	rundll32.exe
PID 4904 wrote to memory of 708	4904	rundll32.exe	rundll32.exe
PID 4904 wrote to memory of 708	4904	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\186037ec84f11a9bb0eef72bc7c30408_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4904

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\186037ec84f11a9bb0eef72bc7c30408_JaffaCakes118.dll,#1
2⤵
PID:708