49bb560db3d2121f105ed67b95d6dbc3330159966fd08fc264357d08646f062e

Analysis

max time kernel
92s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13-05-2024 22:02

Target

3cbf25db0e46f92504db77c450f0b464_JaffaCakes118.dll
Size

77KB
MD5

3cbf25db0e46f92504db77c450f0b464
SHA1

9c58153d746f85cf5e13ed1f5ac6341ce2ab87f8
SHA256

49bb560db3d2121f105ed67b95d6dbc3330159966fd08fc264357d08646f062e
SHA512

4f57bbc26c0d5029734a5388cfe337599a25ca34ed9a066baeeb4a30e2a044573e5681c87c7fd3235dbf5af1578c3a25a36b31917b9afadd08d481dbde5e5f22
SSDEEP

1536:F2lFYHQuwVl8FIW6kWBybsDC/eXV6238fqvt6aHTajCZiPa2nN8v9033XA:FUA2l8FIWGQA/FrD06YXnWlmQ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 3052	5052	rundll32.exe	81
PID 5052 wrote to memory of 3052	5052	rundll32.exe	81
PID 5052 wrote to memory of 3052	5052	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3cbf25db0e46f92504db77c450f0b464_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3cbf25db0e46f92504db77c450f0b464_JaffaCakes118.dll,#1
  2⤵
  PID:3052