110673c3112c87e23b54657fb1472ae382431b043336179b2ae7dbbd501bf75d

Analysis

max time kernel
99s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
17-05-2024 09:46

Target

4f67cab961d7c60920eb418e5b5439c1_JaffaCakes118.dll
Size

121KB
MD5

4f67cab961d7c60920eb418e5b5439c1
SHA1

959240857ab2b3b5e814b54fd7f34db8a1c552d9
SHA256

110673c3112c87e23b54657fb1472ae382431b043336179b2ae7dbbd501bf75d
SHA512

c69506b42c4e34e0dfd8fdaa1e7850065cc4b539ac7aaa45eb938dff2c87e44b91a9e0e2ba25986dbe3a348294cd15e225a1da046325eba3b322f7bf48fdb9f9
SSDEEP

3072:PDFCbEk0UQDKsSa8rBZLHr0ZMXT/fqsyJVANBcTcuiyfRTq:PD/NutiMXDfqoBGBfRTq

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2988 wrote to memory of 4744	2988	rundll32.exe	rundll32.exe
PID 2988 wrote to memory of 4744	2988	rundll32.exe	rundll32.exe
PID 2988 wrote to memory of 4744	2988	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4f67cab961d7c60920eb418e5b5439c1_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2988

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4f67cab961d7c60920eb418e5b5439c1_JaffaCakes118.dll,#1
2⤵
PID:4744