4ef449384c577a30cda4866979579c6307d09f0f8b0bf9d317fc680991c05a2c

Analysis

max time kernel
140s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 14:12

Target

34fbce2710cdde4ad9ff41a9782444d5_JaffaCakes118.dll
Size

18KB
MD5

34fbce2710cdde4ad9ff41a9782444d5
SHA1

71dd03bcfcaf1d0b5b572acd2776d961b35440f1
SHA256

4ef449384c577a30cda4866979579c6307d09f0f8b0bf9d317fc680991c05a2c
SHA512

c476ad2bb843841612f3ca847fc485a809e3617f948831cd1bccdc7320f07e30ae28a078cb5e40f5be08cb5eed3c9752d6fb42a08b7e74265d804b6f5956a444
SSDEEP

384:+d8DOz2kQGyyCMy81IcydNkCYHP1ZGJ5rmyDHbjzPw3o:+d8sC3819ydGNu7Pw3

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3312 wrote to memory of 4436	3312	rundll32.exe	83
PID 3312 wrote to memory of 4436	3312	rundll32.exe	83
PID 3312 wrote to memory of 4436	3312	rundll32.exe	83
PID 4436 wrote to memory of 3004	4436	rundll32.exe	84
PID 4436 wrote to memory of 3004	4436	rundll32.exe	84
PID 4436 wrote to memory of 3004	4436	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\34fbce2710cdde4ad9ff41a9782444d5_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3312
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\34fbce2710cdde4ad9ff41a9782444d5_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4436
- - C:\Windows\SysWOW64\expand.exe
    expand.exe -r "C:\Users\Admin\AppData\Local\Temp\34fbce2710cdde4ad9ff41a9782444d5_JaffaCakes118.dll\..\360ini.cab"
    3⤵
    PID:3004