9e1e508a5acdc3cd99d269fce80542b9257cdc90b49d0ad08f408891bb8d5a86

Analysis

max time kernel
51s
max time network
56s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 17:53

Target

16f1220c93d2997858ab9258d589bcdf_JaffaCakes118.dll
Size

34KB
MD5

16f1220c93d2997858ab9258d589bcdf
SHA1

e60701f00778f0f9acfeb42b6937068f54958095
SHA256

9e1e508a5acdc3cd99d269fce80542b9257cdc90b49d0ad08f408891bb8d5a86
SHA512

8e059d30f1585cdb5a3bd5dc78f08139c38fc574503d8bfc1adf41f1d10936c0b7127b7a070795ed84ad4e24f0d5d2a1f5197973e08c838898d408eb4a7a4734
SSDEEP

768:RHGSziTNPn5f5dYQ7dCguH+sIIJGr5+RMM:RmKiNn5f5r7dCguH+sLIERr

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4724 wrote to memory of 968	4724	rundll32.exe	83
PID 4724 wrote to memory of 968	4724	rundll32.exe	83
PID 4724 wrote to memory of 968	4724	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\16f1220c93d2997858ab9258d589bcdf_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\16f1220c93d2997858ab9258d589bcdf_JaffaCakes118.dll,#1
  2⤵
  PID:968