5057307b8c0497f3c759617e3ff3bab382a935fc3cb01bd68888851bc2310940

Analysis

max time kernel
139s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
17-07-2024 07:29

Target

51fdc41f07061c267cbade6a23e8bd8d_JaffaCakes118.dll
Size

75KB
MD5

51fdc41f07061c267cbade6a23e8bd8d
SHA1

c5078e992a1aefd0b77971300e44dd0dc18b678b
SHA256

5057307b8c0497f3c759617e3ff3bab382a935fc3cb01bd68888851bc2310940
SHA512

31f739f44200dc4d49b2e44a81d7dd301f92291026e7fe1c22959e7123bdb30c05449b6b4ac003d339488397ddcbe9b4a58a4b32780a9740903b9ef1bc8e32e7
SSDEEP

1536:22N42HHyw9MMqVfX5zFnToIfCcTF4r5Z5++++++++++++++++HK++++++++++++c:LN4bVfXNtTBf3TF4r5ZSNbW5YXrg

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1848 wrote to memory of 4908	1848	rundll32.exe	rundll32.exe
PID 1848 wrote to memory of 4908	1848	rundll32.exe	rundll32.exe
PID 1848 wrote to memory of 4908	1848	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\51fdc41f07061c267cbade6a23e8bd8d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1848

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\51fdc41f07061c267cbade6a23e8bd8d_JaffaCakes118.dll,#1
2⤵
PID:4908