04918646acecac9f8b31f89b4de3e9fbeec63e664096b08786a2ab4d4edcbedc

Analysis

max time kernel
139s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16-05-2024 13:42

Target

4b5d53176a0b51ec4f3c84518ef25666_JaffaCakes118.dll
Size

1.1MB
MD5

4b5d53176a0b51ec4f3c84518ef25666
SHA1

d50ff6f653c4200323c22e29e4a4cf6f7780b38a
SHA256

04918646acecac9f8b31f89b4de3e9fbeec63e664096b08786a2ab4d4edcbedc
SHA512

571b1ecbe7ffa155c02e19602d48995617594321b17450a8823c6b6202b65217c83ef31cde3941cc70139513016c45514daec6487ddf34618a59cd51f618d36b
SSDEEP

24576:mqIcHeM6VFTdNZTq82PbF1m5t1cMrM4De+fjdF:QcZEz5T0WjFocfhF

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 692 wrote to memory of 4436	692	rundll32.exe	rundll32.exe
PID 692 wrote to memory of 4436	692	rundll32.exe	rundll32.exe
PID 692 wrote to memory of 4436	692	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b5d53176a0b51ec4f3c84518ef25666_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:692

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b5d53176a0b51ec4f3c84518ef25666_JaffaCakes118.dll,#1
2⤵
PID:4436