04cc4674cabdf96c95e0a7ce0aa38f01d229107ae8419b620d0cd9f68a0dfde2

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2024, 16:05

Target

b4616c8323c251544f60d6f8fa455f71_JaffaCakes118.dll
Size

192KB
MD5

b4616c8323c251544f60d6f8fa455f71
SHA1

d94238a45bd7a082485a41876528ea5a3faf93bb
SHA256

04cc4674cabdf96c95e0a7ce0aa38f01d229107ae8419b620d0cd9f68a0dfde2
SHA512

f5e2e7469b80f8c09e3cd032faee4e3056ec36192873751be2da1d1a8ee048d450cc8d52e93ad43326fdcf04761c6cf0b596e164485e422e21ee0b0117c0a641
SSDEEP

3072:wNbpOnPsGqQTruHLD7RcQxKrrdNU0VAtrOpOOWxOv4Kn7qbjx7T/Hrmj2s:wNbqaLD7RcukVAtSQOWcgWqbV77Lmjf

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 1804	1808	rundll32.exe	81
PID 1808 wrote to memory of 1804	1808	rundll32.exe	81
PID 1808 wrote to memory of 1804	1808	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4616c8323c251544f60d6f8fa455f71_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4616c8323c251544f60d6f8fa455f71_JaffaCakes118.dll,#1
  2⤵
  PID:1804