ca1c04403fac4f1416f2ad34cb653e88adf59ca3847e58f5f5c1d5e64f5cb084

Analysis

max time kernel
93s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29-05-2024 18:21

Target

81727a02f55357248e848dcbfeba5b3c_JaffaCakes118.dll
Size

60KB
MD5

81727a02f55357248e848dcbfeba5b3c
SHA1

31606a3c4bf016815998904eac2aacceded813d7
SHA256

ca1c04403fac4f1416f2ad34cb653e88adf59ca3847e58f5f5c1d5e64f5cb084
SHA512

95203273ee0df390cf94a0a9d7fcafc84f202fa3908076387dbeaeb76f75c7ca36518a5063caf5b3398df235a7dc88971d553543433bc0f25b400a415bf747bd
SSDEEP

1536:WrRQtfuQCsB9wSuiRhtmgxojowvWVPE0eJog620aQF:ykm+GdiRhtmToD26FaE

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3360 wrote to memory of 1676	3360	rundll32.exe	84
PID 3360 wrote to memory of 1676	3360	rundll32.exe	84
PID 3360 wrote to memory of 1676	3360	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\81727a02f55357248e848dcbfeba5b3c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3360
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\81727a02f55357248e848dcbfeba5b3c_JaffaCakes118.dll,#1
  2⤵
  PID:1676