53e19bb936e557cb2d29b2b4ade6d6927082d372b7ed3d0b9979978459855313

Analysis

max time kernel
121s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 13:35

Target

34efa4193c47ea41353b2d1f13d8242a_JaffaCakes118.dll
Size

35KB
MD5

34efa4193c47ea41353b2d1f13d8242a
SHA1

83441b9bbb26b2febbf6c9aa9e6dfd9b057acfc2
SHA256

53e19bb936e557cb2d29b2b4ade6d6927082d372b7ed3d0b9979978459855313
SHA512

ae4296bfad39b024a98f4b021d0c1bf5ab260aedc7c4ccbb5c4763dec8831881c4258f514f1b77940060d849cf602099ff2d3f8c48524818faa9bf388386444d
SSDEEP

384:bsEs2g29TMEW/R2M/RLcQqXWKTLsZMJgA4A3CElGrMrlp/l6SJFg7WROmhvlFZO7:oSg2id/CcZ2CABpj/UWROm9a8OJhEOb

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3208 wrote to memory of 4600	3208	rundll32.exe	83
PID 3208 wrote to memory of 4600	3208	rundll32.exe	83
PID 3208 wrote to memory of 4600	3208	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\34efa4193c47ea41353b2d1f13d8242a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3208
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\34efa4193c47ea41353b2d1f13d8242a_JaffaCakes118.dll,#1
  2⤵
  PID:4600