22f3c95028c42483c405dfeb2bce493f0434f0e26ed790bbd016688677c97f83

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20-06-2024 10:51

Target

054ebcb3ff70166c32d4fb7468bfdfe8_JaffaCakes118.dll
Size

18KB
MD5

054ebcb3ff70166c32d4fb7468bfdfe8
SHA1

1138d16d4880dfcc23196901330d7a1355f15177
SHA256

22f3c95028c42483c405dfeb2bce493f0434f0e26ed790bbd016688677c97f83
SHA512

7b0355c1bfc3425f68e80e2bda1786e6d2fc6838c1cfaa9b50ef063630e036970b849aa2c66cfb1559d15190f4e1d2f9f161477a67e36fbc136ddc69adcf6563
SSDEEP

384:mR5QDTqB22sopQ/+8DJ+AVL11UN6B2GHOAzpGIuYi:kQDTqU2hpQG3AJHUg2OHp

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3144 wrote to memory of 1892	3144	rundll32.exe	82
PID 3144 wrote to memory of 1892	3144	rundll32.exe	82
PID 3144 wrote to memory of 1892	3144	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\054ebcb3ff70166c32d4fb7468bfdfe8_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\054ebcb3ff70166c32d4fb7468bfdfe8_JaffaCakes118.dll,#1
  2⤵
  PID:1892