9801ea6ea41220f101cbeca1cd3a2bbb033ccb9f04b3e121b62c47b2cb4112cc

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04-06-2024 19:44

Target

960a14f61af3e94c0702736f097dab03_JaffaCakes118.dll
Size

277KB
MD5

960a14f61af3e94c0702736f097dab03
SHA1

0f0d1e38b522de60976a229872d7691cd1288f73
SHA256

9801ea6ea41220f101cbeca1cd3a2bbb033ccb9f04b3e121b62c47b2cb4112cc
SHA512

500df57c19673f93039341f697ac9e93e17e659b225e9736d496b7dfa7248e7f014add640ebbb22e07a45db779181db82f36f92a7ab20a6ab95cd79c6cd9a10a
SSDEEP

6144:7RWLJJp6tgWJLsnp5TlovshucMRuDdIGptJqlalRtNwh8zGd34:IFJeCTTc8uyiGptJqglfNwhRI

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3748 wrote to memory of 4180	3748	rundll32.exe	rundll32.exe
PID 3748 wrote to memory of 4180	3748	rundll32.exe	rundll32.exe
PID 3748 wrote to memory of 4180	3748	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\960a14f61af3e94c0702736f097dab03_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3748

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\960a14f61af3e94c0702736f097dab03_JaffaCakes118.dll,#1
2⤵
PID:4180