abf531c1e6e61673ca2063a3186b0a08171091ebfd8e6fa9224fc295d5ac0b34

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 11:49

Target

1b2ea6e762ffea0dc1ded1f9421eaea0_JaffaCakes118.dll
Size

25KB
MD5

1b2ea6e762ffea0dc1ded1f9421eaea0
SHA1

a581a0ad95267347b86e50b31a86491b6a0492b3
SHA256

abf531c1e6e61673ca2063a3186b0a08171091ebfd8e6fa9224fc295d5ac0b34
SHA512

a221eef621bd65f491ac24140a85ad2d10d0aadff9c71a391ba8bf47e3fe67494b6610b32f3841d31fe1a0a79c5459da13332e4973c017376958684575e7775c
SSDEEP

768:vYvxdCXexkjpjp2SHcGXnZZsE4zUlKXbCu:v4nxalV8GJZsE4zgi

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5060 wrote to memory of 4524	5060	rundll32.exe	82
PID 5060 wrote to memory of 4524	5060	rundll32.exe	82
PID 5060 wrote to memory of 4524	5060	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1b2ea6e762ffea0dc1ded1f9421eaea0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5060
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1b2ea6e762ffea0dc1ded1f9421eaea0_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4524