d01e025c529877b9b3ae18652fe88ef343807fa460dc9c387610cb6258d4fc79

Analysis

max time kernel
140s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 00:49

Target

6182488bb294df4e41793bebc71a00d3_JaffaCakes118.dll
Size

207KB
MD5

6182488bb294df4e41793bebc71a00d3
SHA1

0b9196addfe5e5ab45468b6f8460e71010cd1f2f
SHA256

d01e025c529877b9b3ae18652fe88ef343807fa460dc9c387610cb6258d4fc79
SHA512

ac70b10cfb701e5f9b7942f5a15822fb4235f2536d5962e9aa73ccbcaceb13fcd5546c8b54ef9a747f7a2b3d9bc6bf20011c19067795103d0bbe193b8a5ca413
SSDEEP

3072:KlC60GeD6N9Za5Yp6zPC952DmKX0tDV2/jqBkLcP6j5UZm5s:KNxfaWUzPWEKKX0pURLcyjef

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3740 wrote to memory of 228	3740	rundll32.exe	rundll32.exe
PID 3740 wrote to memory of 228	3740	rundll32.exe	rundll32.exe
PID 3740 wrote to memory of 228	3740	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6182488bb294df4e41793bebc71a00d3_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3740

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6182488bb294df4e41793bebc71a00d3_JaffaCakes118.dll,#1
2⤵
PID:228