100ad35bc41ad07baea43e66e8b69b57b765fffb103464f9ea6cc61eaeb8bebd

Analysis

max time kernel
138s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 20:33

Target

47ea2fc0172f1561436681b5eb8e789c_JaffaCakes118.dll
Size

1.0MB
MD5

47ea2fc0172f1561436681b5eb8e789c
SHA1

f58c510f0ecff8a4f62c4b5ee5260cfd2481707c
SHA256

100ad35bc41ad07baea43e66e8b69b57b765fffb103464f9ea6cc61eaeb8bebd
SHA512

fe601404091c72447397ac262403a17671619b25bb69087c11142fa17631c27a57929993c59aa87db034497f39ae428e1dd4cc73dea9db1d6c546a755b23f69b
SSDEEP

24576:2KeFRSUBZD0XpZQUYEu+pS0+M3tb0pvaep5ZUYuZ:IFjBh0jdDu/0J3tCieDIZ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 2472	1508	rundll32.exe	83
PID 1508 wrote to memory of 2472	1508	rundll32.exe	83
PID 1508 wrote to memory of 2472	1508	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\47ea2fc0172f1561436681b5eb8e789c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\47ea2fc0172f1561436681b5eb8e789c_JaffaCakes118.dll,#1
  2⤵
  PID:2472