8bc87086c770d0d22aa70689077b09578bd948878d9df5b4ad33024edfc87f5c

Analysis

max time kernel
132s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03-06-2024 05:46

Target

90b8c3a5f27d562bec7114da9823bde5_JaffaCakes118.dll
Size

14KB
MD5

90b8c3a5f27d562bec7114da9823bde5
SHA1

449bcb9c620edc592d20865ee8ee2757f363f34d
SHA256

8bc87086c770d0d22aa70689077b09578bd948878d9df5b4ad33024edfc87f5c
SHA512

e5a3da136db07b7434bfaa7671b8496ef3d375245bb6716ef586ef6e97ff67023e9fa5c37295ef170f5793c2f84408a24913e166bfefef357b5ff8aaf8690ed3
SSDEEP

384:oeyxDuzzKmFGqBDKqTGBd4+xBPQ/e17f/85O2nblU2yOChYp:oesyqmFVeBBS6OK7f/+Uq6

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 4364	5040	rundll32.exe	83
PID 5040 wrote to memory of 4364	5040	rundll32.exe	83
PID 5040 wrote to memory of 4364	5040	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\90b8c3a5f27d562bec7114da9823bde5_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\90b8c3a5f27d562bec7114da9823bde5_JaffaCakes118.dll,#1
  2⤵
  PID:4364

memory/4364-0-0x000000001E1F0000-0x000000001E1FA000-memory.dmp

Filesize
40KB

Download