a7acace7c211690a48e2e1ba5207520189b65913b3eadb4e300f3a124b733984

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 05:09

Target

90a1ef650b3ce5d08f4773d3d995ee18_JaffaCakes118.dll
Size

193KB
MD5

90a1ef650b3ce5d08f4773d3d995ee18
SHA1

0df75b4e029c063221988a420330515e5dbf0a7f
SHA256

a7acace7c211690a48e2e1ba5207520189b65913b3eadb4e300f3a124b733984
SHA512

15ea79de045ab08517c768920bd10cae5cd95ff93233e67cf0a19067177ca8132842a2cf6787189c444fd1447070f392131a29ebd1648d010ba4b6cf706000fe
SSDEEP

3072:/C+uxfp04D0djfdi3z3D2UuzSwyKbppTIEOOlMAChaST7ib/4NFg:/ixR0a6dqLAzMmTBC/Gv

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 1256	3004	rundll32.exe	82
PID 3004 wrote to memory of 1256	3004	rundll32.exe	82
PID 3004 wrote to memory of 1256	3004	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\90a1ef650b3ce5d08f4773d3d995ee18_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\90a1ef650b3ce5d08f4773d3d995ee18_JaffaCakes118.dll,#1
  2⤵
  PID:1256