4df76c4ae028aab008a6121202b8db45747982be121bd7650a9df7efbc2c709b

Analysis

max time kernel
51s
max time network
54s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 06:17

Target

0390a910d19caa428c0125320fac6241_JaffaCakes118.dll
Size

89KB
MD5

0390a910d19caa428c0125320fac6241
SHA1

54cc329880c1aec718eb81e5ca6eba7ee23c12c4
SHA256

4df76c4ae028aab008a6121202b8db45747982be121bd7650a9df7efbc2c709b
SHA512

6c3881cec407e232819da3dd2d32fff0f96ced6a55e66494a5107621548fc00ffa4c8770c89291a4a4da887f73b2524bd1a68b8da03109c4d4d95bb159023d56
SSDEEP

1536:pkuacOnTIQTiOobuM03cxMDub4goNFKrGK9+lVHYVHWoLAt:racHQfTd3cxr8gy/t

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 3132	1968	rundll32.exe	81
PID 1968 wrote to memory of 3132	1968	rundll32.exe	81
PID 1968 wrote to memory of 3132	1968	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0390a910d19caa428c0125320fac6241_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0390a910d19caa428c0125320fac6241_JaffaCakes118.dll,#1
  2⤵
  PID:3132