051ac5f2349d279202d10396da72fcd5af463ea49bdc25d20514c7c1887d172c

Analysis

max time kernel
134s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 09:02

Target

89f6eb298e67e583cdd6d42c26508a49_JaffaCakes118.dll
Size

1.1MB
MD5

89f6eb298e67e583cdd6d42c26508a49
SHA1

3830aa854e5d41e99d78c7e5dd363f7181145885
SHA256

051ac5f2349d279202d10396da72fcd5af463ea49bdc25d20514c7c1887d172c
SHA512

7fd0aa9a43bf3a1e14d5f43bdfebd0f28ee50feefb8fb2d0b58dfd29ceb0de20bfd1dc5d8c1fc8e74d8d2a197c5f021dd3fca62452256b40a0a43c9ae2d9f75c
SSDEEP

24576:21yYigJX3Amdgju+pS0+M3tb0pvaep5ZyWLR:rx+AmGju/0J3tCieD9R

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 60 wrote to memory of 4200	60	rundll32.exe	83
PID 60 wrote to memory of 4200	60	rundll32.exe	83
PID 60 wrote to memory of 4200	60	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\89f6eb298e67e583cdd6d42c26508a49_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:60
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\89f6eb298e67e583cdd6d42c26508a49_JaffaCakes118.dll,#1
  2⤵
  PID:4200