cfe9ae4333166f161667c3fb252ddefb5f3db2282bc0701535422be9b5289524

Analysis

max time kernel
142s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 08:18

Target

154b8c03b183ffedc445954b5aee2a1e_JaffaCakes118.dll
Size

36KB
MD5

154b8c03b183ffedc445954b5aee2a1e
SHA1

86b38a6414377d68ffd8217ac692cf78a6f77b65
SHA256

cfe9ae4333166f161667c3fb252ddefb5f3db2282bc0701535422be9b5289524
SHA512

359b6fd5781621b0b0266fff8e9288822c32c3054e19b2fc0706c18b45c1066d6ddc1b47499d687e506bf50bf7449af2165a02cb93c187c2d19f97f2545dc3e1
SSDEEP

768:jldjeazLJ73PSindj9tuVqFqH7Pdvlr5hCD8ROjMV:jjjeUJ73PRtuVq67F9lQgROji

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 4928	4828	rundll32.exe	83
PID 4828 wrote to memory of 4928	4828	rundll32.exe	83
PID 4828 wrote to memory of 4928	4828	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\154b8c03b183ffedc445954b5aee2a1e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\154b8c03b183ffedc445954b5aee2a1e_JaffaCakes118.dll,#1
  2⤵
  PID:4928