0a496acefa5d425fe0d4afc6d0b3978228ab51e62865351676a41f22eaa32196

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2024, 03:24

Target

b68940cfc5020d726451dde689d20660_JaffaCakes118.dll
Size

98KB
MD5

b68940cfc5020d726451dde689d20660
SHA1

897b01055b0eb324ad535c79fdce9fdacae8acf2
SHA256

0a496acefa5d425fe0d4afc6d0b3978228ab51e62865351676a41f22eaa32196
SHA512

0e103811deb56f2acff2681396b1e1c4bd5763300e57f2321a1b0d3f6a5c122815eddc39d4c20efde89241a21e4fe810ae41bdb6b7a3135eac397c401cc0de2a
SSDEEP

1536:pMyRA59WdP9SGSEtgcledgb/5uTZ+qbwMaTAL5jGV3mQrwaT54gZHaCh45T3:DR+9WdP9SMtgcllx4blje3mudTOgseA

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 1988	1240	rundll32.exe	82
PID 1240 wrote to memory of 1988	1240	rundll32.exe	82
PID 1240 wrote to memory of 1988	1240	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b68940cfc5020d726451dde689d20660_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b68940cfc5020d726451dde689d20660_JaffaCakes118.dll,#1
  2⤵
  PID:1988