90d25c59a7728219248740356a6d53144966503db226ce50f4f1f683f8bd9794

Analysis

max time kernel
93s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10-07-2024 22:14

Target

369c124888119c315ae9228931e2e6b4_JaffaCakes118.dll
Size

228KB
MD5

369c124888119c315ae9228931e2e6b4
SHA1

12b77369c20f7d69f9a44009da0a87a45451151a
SHA256

90d25c59a7728219248740356a6d53144966503db226ce50f4f1f683f8bd9794
SHA512

f20f50c73747e38883dfc7532439d7a29cfccbcb8691f03d9516d62b63c4d62ad1be49359e0c0dfd7757d85dc0a526a0a60b60e2d4e02053b846446098196593
SSDEEP

3072:Ml6RSfsf5eNHLGJ8NYlRxdi8x3gXBnFkl790eRehnpyX3xAjtU/CwTBZ:gDIndxhIniCeMp+

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4408 wrote to memory of 1188	4408	rundll32.exe	83
PID 4408 wrote to memory of 1188	4408	rundll32.exe	83
PID 4408 wrote to memory of 1188	4408	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\369c124888119c315ae9228931e2e6b4_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4408
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\369c124888119c315ae9228931e2e6b4_JaffaCakes118.dll,#1
  2⤵
  PID:1188