e462af1a98d0ad5cd369792ab8789dfb92de26f02d281705f3a1a4ae403536bd

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2024, 04:23

Target

5d29e7ab8cb09a92b2dba14a5a255b50_JaffaCakes118.dll
Size

280KB
MD5

5d29e7ab8cb09a92b2dba14a5a255b50
SHA1

d88be2ae814bb0ba6f9a510366da966be7491328
SHA256

e462af1a98d0ad5cd369792ab8789dfb92de26f02d281705f3a1a4ae403536bd
SHA512

3b2b0492ae238e7833ae079740971a1e642bd8c9ac77e3006f6c5dcb3e118cdda05411ad83c12cbd3c0f69c9329a0ab47cdeb59530939cca9b25016aaf87c084
SSDEEP

6144:GErK4k/3gJH6iIfIGOS+3NuICjkDm8V2YwnwoUYvTJs+pRU:GEEwJH6WS+3NGkDOYwnvrTJ7pRU

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 4360	1908	rundll32.exe	82
PID 1908 wrote to memory of 4360	1908	rundll32.exe	82
PID 1908 wrote to memory of 4360	1908	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5d29e7ab8cb09a92b2dba14a5a255b50_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5d29e7ab8cb09a92b2dba14a5a255b50_JaffaCakes118.dll,#1
  2⤵
  PID:4360