089edcdfd1718e82d742ab60bbc115bc7f61c450cfb74c049d803732a8adc146

Analysis

max time kernel
41s
max time network
49s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03-07-2024 22:30

Target

23aabae74fa4d7c497670b1e0c56edeb_JaffaCakes118.dll
Size

51KB
MD5

23aabae74fa4d7c497670b1e0c56edeb
SHA1

fa7f1ca18b89b46bf3676ff084b65667005a059b
SHA256

089edcdfd1718e82d742ab60bbc115bc7f61c450cfb74c049d803732a8adc146
SHA512

63a3ca1d7cb488b2e70bf77fdd3eee01779e18ba48bb5977c38d373022465ecfa5ea629f0e0b50ec48763f872f33e7804624657b90d50626869e68033f01b169
SSDEEP

768:klQ+Mv3wflXkhMmdT4iscZtg6rBxIqWZ4dfQCjfelE5thU:kq+fNXIx41c3pxddylE5s

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 3188	1820	rundll32.exe	81
PID 1820 wrote to memory of 3188	1820	rundll32.exe	81
PID 1820 wrote to memory of 3188	1820	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\23aabae74fa4d7c497670b1e0c56edeb_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\23aabae74fa4d7c497670b1e0c56edeb_JaffaCakes118.dll,#1
  2⤵
  PID:3188