068bd8fa77af8b4ebf38a68123f00d8224d625fb6971b26dc223727417933866

Analysis

max time kernel
94s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2024, 11:17

Target

ae2b1d0e8d74eb14f3ae9cd9f52d0e7d_JaffaCakes118.dll
Size

192KB
MD5

ae2b1d0e8d74eb14f3ae9cd9f52d0e7d
SHA1

0ca1cf7fda92c20f0da99454888d9c3b3a0c30d5
SHA256

068bd8fa77af8b4ebf38a68123f00d8224d625fb6971b26dc223727417933866
SHA512

eb069a95bc0691715c0a06733b63a91be4f392b1f9d3447d368cec578c548219f247003dca21f39e867d774aa345a5d893029624cfd3a5be30ac5a717d76ec38
SSDEEP

3072:MNbpOnPsGqQTruHLD7RcQxKrrdNU0VAtrOpOOWxOv4Kn7qbjx7T/Hrm6:MNbqaLD7RcukVAtSQOWcgWqbV77Lm6

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 596 wrote to memory of 1840	596	rundll32.exe	82
PID 596 wrote to memory of 1840	596	rundll32.exe	82
PID 596 wrote to memory of 1840	596	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ae2b1d0e8d74eb14f3ae9cd9f52d0e7d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:596
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ae2b1d0e8d74eb14f3ae9cd9f52d0e7d_JaffaCakes118.dll,#1
  2⤵
  PID:1840