71d58cf4534a75a7b4d3ec4ef6bb1e1bf379d0913f7173be6b7b1d68ef1936bf

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01/05/2024, 11:38

Target

0bb2b116267a8dd2e5a5b414d90e7dfe_JaffaCakes118.dll
Size

69KB
MD5

0bb2b116267a8dd2e5a5b414d90e7dfe
SHA1

1dd2a423cbde3c717a4324f1d79fbac82d0be3bb
SHA256

71d58cf4534a75a7b4d3ec4ef6bb1e1bf379d0913f7173be6b7b1d68ef1936bf
SHA512

1d939df4207fdf2405103a6587b8fba5f9f2709cbfb4ae38ad3bdc0f54041dfdc24feb75d7b9b576d99fc43ca366f3d8ed148039eca447a2b2078e23d9ebf0d9
SSDEEP

1536:lksmsapPV5kcMmWEqO5F8CxxcUsD0EYfDY5KE1PeFIWtE:msmsaprkcBWEqs80xcUuK2WFIf

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 2412	1672	rundll32.exe	81
PID 1672 wrote to memory of 2412	1672	rundll32.exe	81
PID 1672 wrote to memory of 2412	1672	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0bb2b116267a8dd2e5a5b414d90e7dfe_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0bb2b116267a8dd2e5a5b414d90e7dfe_JaffaCakes118.dll,#1
  2⤵
  PID:2412