064348bd532e724431da24593a55af29b52bebb027744668296560be0b293342

Analysis

max time kernel
139s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2024, 07:35

Target

0de57e404ac0e9c7431377a55130748e_JaffaCakes118.dll
Size

58KB
MD5

0de57e404ac0e9c7431377a55130748e
SHA1

7c34d0b27ad5c175a2fc22fa0c18f320a601c190
SHA256

064348bd532e724431da24593a55af29b52bebb027744668296560be0b293342
SHA512

31edf6d956ae515f4af0998dcb5dcb8a047dcc7cfc062ad5918170cabd560ef68e3f20bb68bb60f92afd28a2f8488cc84b9c56856d4d4b64ec18931825d340ec
SSDEEP

1536:HLbWEo25hu8mgpJ5DWmGK81Vc+4G9cpDpo6q5cyL:HHFo2jIgpJHGK8vcNGupDvyL

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 1164	1520	rundll32.exe	85
PID 1520 wrote to memory of 1164	1520	rundll32.exe	85
PID 1520 wrote to memory of 1164	1520	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0de57e404ac0e9c7431377a55130748e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0de57e404ac0e9c7431377a55130748e_JaffaCakes118.dll,#1
  2⤵
  PID:1164