1b16fe35e2b18d8c22674144251193ca86cbde6a46e6f353f99b21cc0941c2c5

Analysis

max time kernel
138s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 07:37

Target

5b01faedc156c1f1d220eadd1a79d0a5_JaffaCakes118.dll
Size

31KB
MD5

5b01faedc156c1f1d220eadd1a79d0a5
SHA1

aa9a86abfc79bcfd409b89215f4fafc61bbd3325
SHA256

1b16fe35e2b18d8c22674144251193ca86cbde6a46e6f353f99b21cc0941c2c5
SHA512

9a84d55737aa02859a3a102688326ef7eca86c36ef9bae38c2ae9f2d09dfa7b45ada77a5789e7fd77a8ce6838de54061b5981d570f23acdb15f4629a765c5990
SSDEEP

384:iWfKO4Q3Yd9jzLGalTmaUsJaloQ/+69hJLED0DNxkjIewSOdZj2nVGvT1iSIPghW:iWvf3YHjHjzQ/hfI0DNq/mT1izPT4U

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 3892	2196	rundll32.exe	84
PID 2196 wrote to memory of 3892	2196	rundll32.exe	84
PID 2196 wrote to memory of 3892	2196	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5b01faedc156c1f1d220eadd1a79d0a5_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5b01faedc156c1f1d220eadd1a79d0a5_JaffaCakes118.dll,#1
  2⤵
  PID:3892