6d760b4b8f403f9c473ccc0f3f9fee66fbccccb0ac6844e4e6f9a8a0063c2d4c

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 09:26

Target

fc70262a5b507600422219cb49ab031b_JaffaCakes118.dll
Size

91KB
MD5

fc70262a5b507600422219cb49ab031b
SHA1

b2bd014089f287df15ca45c8e8190c36a1748eb1
SHA256

6d760b4b8f403f9c473ccc0f3f9fee66fbccccb0ac6844e4e6f9a8a0063c2d4c
SHA512

0196284db285b88e4230988da0920d3ec3ec588ea6d9aee133ee21236743d39a08238e9f61d99b31321de485a0166411cab493dff9ade7624da3eb92f73069c6
SSDEEP

1536:hr4yUe0rMJ8DBCnRkRP7HabuNHUQ01YkKdyS14OT6CZnpfl3vkqHO7L2mz/MEPHD:hxR02buNHu+ySiOuCL1kqHc0EPHyM

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 888 wrote to memory of 3516	888	rundll32.exe	85
PID 888 wrote to memory of 3516	888	rundll32.exe	85
PID 888 wrote to memory of 3516	888	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fc70262a5b507600422219cb49ab031b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:888
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fc70262a5b507600422219cb49ab031b_JaffaCakes118.dll,#1
  2⤵
  PID:3516