a73b2bb7dbdc94fb9502090a0caf7745e7e204c68be0035d389700083fc1ed5e

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 16:17

Target

23024069ab319ca3ce8048b7609adbbf_JaffaCakes118.dll
Size

159KB
MD5

23024069ab319ca3ce8048b7609adbbf
SHA1

0d1bfa7eeb2c109f6b0ee96db45649c072a65bed
SHA256

a73b2bb7dbdc94fb9502090a0caf7745e7e204c68be0035d389700083fc1ed5e
SHA512

a27fef257a9c23c4b20069d70385e1ad0c168bb78cf42dfac72b61a909a472b24d484d123e898b72308be208f33fc4b7ee4a97c423a500848fd3bae3288f0b0a
SSDEEP

3072:+Ishxxk2BhbBxnoa5Yiq1gqhMttYF3Bb2tx4/NT6ydJKM5cEH+pVXO21mCT2:rshAyhbBtNyFstkckcvpVXOGm

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 4780	2652	rundll32.exe	81
PID 2652 wrote to memory of 4780	2652	rundll32.exe	81
PID 2652 wrote to memory of 4780	2652	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\23024069ab319ca3ce8048b7609adbbf_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\23024069ab319ca3ce8048b7609adbbf_JaffaCakes118.dll,#1
  2⤵
  PID:4780