04a75b67321c6dbfe75ce1ff08220446ae4c3ff06adb65f2f5cf5d3124403ae1

Analysis

max time kernel
93s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 02:12 UTC

Target

27cbf3b0244a31aad25df685859f8023_JaffaCakes118.dll
Size

1.0MB
MD5

27cbf3b0244a31aad25df685859f8023
SHA1

2b812b2d68f612de69c135aa940ccdafaad32115
SHA256

04a75b67321c6dbfe75ce1ff08220446ae4c3ff06adb65f2f5cf5d3124403ae1
SHA512

b1f6fcf8f9979eed0cccd09b59a3cb70aeb3f147ea8aabe38a57c97cd447eeb100598b9d8d5f301e29f0216244880bb454a655202196c3197e26947a77504df3
SSDEEP

24576:alsTXlc5VKbeu+pS0+M3tb0pvaep5ZV1yji:ZT2u/0J3tCieDki

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 372 wrote to memory of 1460	372	rundll32.exe	80
PID 372 wrote to memory of 1460	372	rundll32.exe	80
PID 372 wrote to memory of 1460	372	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\27cbf3b0244a31aad25df685859f8023_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:372
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\27cbf3b0244a31aad25df685859f8023_JaffaCakes118.dll,#1
  2⤵
  PID:1460

No results found