910bde7235a29f8524429be2f9db14c9d0bc4bbf18e4dd4494cdddf6999e84ce

Analysis

max time kernel
135s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07-05-2024 19:22

Target

215f06947169991047c61cd4f67f2688_JaffaCakes118.dll
Size

1.0MB
MD5

215f06947169991047c61cd4f67f2688
SHA1

3b5270d258f3fe797fcf868faa925e97902a4ef7
SHA256

910bde7235a29f8524429be2f9db14c9d0bc4bbf18e4dd4494cdddf6999e84ce
SHA512

871bffab240ad1d1577538e385750eb41c47cdc4c0de7663677de7d38883a9afaf279dfcbd79a30f9de8a56281ad4e06929f2fc979d3a0eaef8fa20945a99e19
SSDEEP

24576:UvrkzDwTmgssOyebMv8qwLne4dmZunyENog24Jfn4/:u3aszeVnUZuioJfQ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3816 wrote to memory of 4636	3816	rundll32.exe	rundll32.exe
PID 3816 wrote to memory of 4636	3816	rundll32.exe	rundll32.exe
PID 3816 wrote to memory of 4636	3816	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\215f06947169991047c61cd4f67f2688_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3816

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\215f06947169991047c61cd4f67f2688_JaffaCakes118.dll,#1
2⤵
PID:4636