5e58cefff6ba61e313db081e68974fc76b2ebc6a0317c0eced01813a01c79c93

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2024, 12:36

Target

0e860259f754b277eaedd63d503d2bf5_JaffaCakes118.dll
Size

67KB
MD5

0e860259f754b277eaedd63d503d2bf5
SHA1

efeb8903f67f161cbc20498f3dda5921017346ec
SHA256

5e58cefff6ba61e313db081e68974fc76b2ebc6a0317c0eced01813a01c79c93
SHA512

0e5e0a10e83abc1951dcd4e30a78f7bde5c273ca502dc5c5f2746321b94891f79946bac4323bbac1f486da181a5ebfdd99b3c3a83fe044cd46548b9fe75b0df2
SSDEEP

1536:pCJ2owF1ap0WiwgrDoE70DJwEuguaOi+epjTdXDu:4Jhwny0RwgX+wMOnep1XDu

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 948 wrote to memory of 964	948	rundll32.exe	85
PID 948 wrote to memory of 964	948	rundll32.exe	85
PID 948 wrote to memory of 964	948	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e860259f754b277eaedd63d503d2bf5_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:948
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e860259f754b277eaedd63d503d2bf5_JaffaCakes118.dll,#1
  2⤵
  PID:964