06a92a05dbb569dcb3f444a3b8cf22709bdaac6dc07b92c78977e016e9fe9b64

Analysis

max time kernel
133s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 05:34

Target

1f9c09a37f5001dcbefbf5799ce40cfd_JaffaCakes118.dll
Size

521KB
MD5

1f9c09a37f5001dcbefbf5799ce40cfd
SHA1

0cb90ae377ba272f30d218e5938e524dbdaca740
SHA256

06a92a05dbb569dcb3f444a3b8cf22709bdaac6dc07b92c78977e016e9fe9b64
SHA512

a6337aa54ee34d3dc090c3d0db99ee90b0b177f465ab73cfe0b38c477b9c515ccab002ade16eb645c31691f04cfb344ef375844c6619210072a5eb172c6bd1be
SSDEEP

12288:Cx2lu2BpLiPwlUfIKKuioD4LP22dwfgtI+BJ:Cx2llsQUfIKKuZAP2cr

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3556 wrote to memory of 4688	3556	rundll32.exe	84
PID 3556 wrote to memory of 4688	3556	rundll32.exe	84
PID 3556 wrote to memory of 4688	3556	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1f9c09a37f5001dcbefbf5799ce40cfd_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1f9c09a37f5001dcbefbf5799ce40cfd_JaffaCakes118.dll,#1
  2⤵
  PID:4688