1b178d92d79eaf185a9a6ed40fa6bf40440fe1caa9ab877df3666c63c19e116c

Analysis

max time kernel
138s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 19:47

Target

68675957386c567a02f8dd508339da33_JaffaCakes118.dll
Size

82KB
MD5

68675957386c567a02f8dd508339da33
SHA1

a5dab15350d8daa1d3d952f72aa12d659d788888
SHA256

1b178d92d79eaf185a9a6ed40fa6bf40440fe1caa9ab877df3666c63c19e116c
SHA512

7d185128c7d137bcd6ef41266ff759783a37d55cb81e0f5ab61e3fa19b5f6015035cd42638e709b05f3bd56e9bbb905d71e4c9fa363a8ec0ae7eab67dddfdacf
SSDEEP

1536:KbsegBnkZ7s/QqvCxvMftPRQ9pTKsWGzacdm4FJke6lemTTVE:GseBp0KJV7m1eEBTTVE

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1352 wrote to memory of 1540	1352	rundll32.exe	rundll32.exe
PID 1352 wrote to memory of 1540	1352	rundll32.exe	rundll32.exe
PID 1352 wrote to memory of 1540	1352	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\68675957386c567a02f8dd508339da33_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\68675957386c567a02f8dd508339da33_JaffaCakes118.dll,#1
  2⤵
  PID:1540