94b08b413139ca74c09830d96eb3cde592ab0f7ca0b884d60dfeff81b43f9f2a

Analysis

max time kernel
132s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 01:39

Target

69521143269a986fc7e7f9f37b38c07d_JaffaCakes118.dll
Size

722KB
MD5

69521143269a986fc7e7f9f37b38c07d
SHA1

557d60b8687a1b934f4fbee0dadec25cdece4178
SHA256

94b08b413139ca74c09830d96eb3cde592ab0f7ca0b884d60dfeff81b43f9f2a
SHA512

9dbb1beb4d28aea389ac984c5ffee9ba146e863d0a5f30f7c2de02164b08e1818e684a936aa5e94de74bf0b8051a48506ac9b1b38d561603599a56ab491a825a
SSDEEP

12288:i733yxBwBilCs8a9uR3TxoWrmYVEXUCG5VFs/kXj6nZaQ7jf7CGy+dptwE4nrX2U:sHyxBCriUIkXx8Wc03Ooc8dHkC2e9

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 1392	4572	rundll32.exe	83
PID 4572 wrote to memory of 1392	4572	rundll32.exe	83
PID 4572 wrote to memory of 1392	4572	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\69521143269a986fc7e7f9f37b38c07d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\69521143269a986fc7e7f9f37b38c07d_JaffaCakes118.dll,#1
  2⤵
  PID:1392