20db817a92a3aa7c714c2cac423d5921e2b675ff805cf853672e429d67d64470

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
16-05-2024 17:55

Target

4c5686008bd2fbf7fed11445179c1db5_JaffaCakes118.dll
Size

1.0MB
MD5

4c5686008bd2fbf7fed11445179c1db5
SHA1

c2dbba7b1906a8b3700ea9bb48dbab8a6cc58734
SHA256

20db817a92a3aa7c714c2cac423d5921e2b675ff805cf853672e429d67d64470
SHA512

3ff8c269a530008cb442383ffbd98f2686b9d09075038bb6fb5f396515e116d575250294c4c2cf276faeb1a93d61d35c0191b0023f7e91438cf7e8d9d7d01205
SSDEEP

12288:BSbulKPtlIP2QyZOzEeWksH5WBKkcTTfk99dbeEp9HQK222ycsVMHB9UESAMf3HR:BAJFlIPWfDH4cDELJ12fzvSnjDX/7R8S

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 5072 wrote to memory of 4316	5072	rundll32.exe	rundll32.exe
PID 5072 wrote to memory of 4316	5072	rundll32.exe	rundll32.exe
PID 5072 wrote to memory of 4316	5072	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c5686008bd2fbf7fed11445179c1db5_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5072

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c5686008bd2fbf7fed11445179c1db5_JaffaCakes118.dll,#1
2⤵
PID:4316