37882b08f927f78fa0d434663fe573745e45c1b2e6bb8f4ea27c6e0c40fdc972

Analysis

max time kernel
138s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2024, 10:57

Target

4fa6050b7669bf71dca7306819b2d8fb_JaffaCakes118.dll
Size

5.5MB
MD5

4fa6050b7669bf71dca7306819b2d8fb
SHA1

ba6556c91215043a1aa8b66e7a893eb8d73221ea
SHA256

37882b08f927f78fa0d434663fe573745e45c1b2e6bb8f4ea27c6e0c40fdc972
SHA512

5bec9c811ce83355f8b4de3182978baa5d728e356f61d1546a10fd972a58d0425db56a5a470edd0d4034385e81b90ec45a5318faa0c1d8f37de6ebd109da588b
SSDEEP

98304:Y2k7N+Tplwx/0/SthC3pM18rDw2CDp/fRyee:Y2k8lwx/nC3pM1Aw2yp/5E

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 2584	1032	rundll32.exe	83
PID 1032 wrote to memory of 2584	1032	rundll32.exe	83
PID 1032 wrote to memory of 2584	1032	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4fa6050b7669bf71dca7306819b2d8fb_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4fa6050b7669bf71dca7306819b2d8fb_JaffaCakes118.dll,#1
  2⤵
  PID:2584