13b715104f8bb5b3fdd315cc569a45a3b13b2a94dd1b6fc6f9c3d5e5669db191

Analysis

max time kernel
129s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
13-05-2024 18:48

Target

3c441d1f2bf669118791227d44203f93_JaffaCakes118.dll
Size

1.0MB
MD5

3c441d1f2bf669118791227d44203f93
SHA1

19a47af2bf2773a8e7a21a4553f54af8eef416f8
SHA256

13b715104f8bb5b3fdd315cc569a45a3b13b2a94dd1b6fc6f9c3d5e5669db191
SHA512

f9102ed1a1f5f3131d38594325a9b0b9390f1c84f8ec4b5afb089ca1ceca3e5f45c336b9e68457952893362f26a451c2d9ce5f0d17cf810dd9c8d2f5cdb3da62
SSDEEP

24576:44gecqOEbj+qD4LBs6xIzd3YMDHNj9QkNdm1yAXwqUzQ55c:4zeB2LBs6xIOMDHNvjmtXnUu5c

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 5044 wrote to memory of 5056	5044	rundll32.exe	rundll32.exe
PID 5044 wrote to memory of 5056	5044	rundll32.exe	rundll32.exe
PID 5044 wrote to memory of 5056	5044	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c441d1f2bf669118791227d44203f93_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5044

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c441d1f2bf669118791227d44203f93_JaffaCakes118.dll,#1
2⤵
PID:5056