6102aaf68ad4aac7a1452192d5c65899ee1c903aab84bf13fa89b60d6f98b80c

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 21:39

Target

f6a099fcd760bb22ce617e7348d508ab_JaffaCakes118.dll
Size

35KB
MD5

f6a099fcd760bb22ce617e7348d508ab
SHA1

950d52413987599239e9a88c8e7cdd47c32046af
SHA256

6102aaf68ad4aac7a1452192d5c65899ee1c903aab84bf13fa89b60d6f98b80c
SHA512

ce5b5eb3a0c4f53bafe11236b2c6b58712f45853849019439bacbeb08fa4b06195d38ec31682cd24bbb0454cd21505559d06c2140496a3df8d99e0f49dbf799d
SSDEEP

768:NPfBvZHWGwuT+dnls7QQnXbJgv3/CODbEiRVcLe:xBv7T+B67QCXbJgv6OEiRGi

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 1040	1860	rundll32.exe	83
PID 1860 wrote to memory of 1040	1860	rundll32.exe	83
PID 1860 wrote to memory of 1040	1860	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f6a099fcd760bb22ce617e7348d508ab_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f6a099fcd760bb22ce617e7348d508ab_JaffaCakes118.dll,#1
  2⤵
  PID:1040