1318a94628221dcafc533eb77bd9f7762fe6cecc9b177c610cf73e7089a3b8ce

Analysis

max time kernel
133s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08-05-2024 05:27

Target

23653e8364ea3b494fd63e65cbdb6bd4_JaffaCakes118.dll
Size

1.1MB
MD5

23653e8364ea3b494fd63e65cbdb6bd4
SHA1

d4194110286414004d0a21d690c91fc93a4c5d42
SHA256

1318a94628221dcafc533eb77bd9f7762fe6cecc9b177c610cf73e7089a3b8ce
SHA512

5e87b18550d52f9ddd086078a001d52abd7e729271485a2cff9e746b38a5fff88055fa38adf8e2e7091e9bf2b06f614ac31e1467abe17a0992e2cd613545c8c0
SSDEEP

24576:7NAsCw0OjKAeQuz1t5DzAe7JS85SqX16qN+RpNBnH4N:ZzCWKAelzNAtcnX13oYN

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4660 wrote to memory of 2256	4660	rundll32.exe	rundll32.exe
PID 4660 wrote to memory of 2256	4660	rundll32.exe	rundll32.exe
PID 4660 wrote to memory of 2256	4660	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\23653e8364ea3b494fd63e65cbdb6bd4_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4660

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\23653e8364ea3b494fd63e65cbdb6bd4_JaffaCakes118.dll,#1
2⤵
PID:2256