cc351a581a6aeee8c07b997e8e8e555359037981fed4bcdb957b8944004dc68c

Analysis

max time kernel
51s
max time network
54s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19/06/2024, 19:03

Target

0014820e823557d18aa94cee8108d6f3_JaffaCakes118.dll
Size

48KB
MD5

0014820e823557d18aa94cee8108d6f3
SHA1

13083890fd199359c3b9af36c1b86d5b9a22e131
SHA256

cc351a581a6aeee8c07b997e8e8e555359037981fed4bcdb957b8944004dc68c
SHA512

2ec8717bbc46c82270e99f9c16720775fc28c5153559a0bb287c67510ad161bb28f99fc4f163718417b7ee74ebe4d9e3a3a186482eb51c7d0a32c7c07056c6a8
SSDEEP

768:NS7MqklszD1jD95N9ar6e4wKQe6DnGQHWnyv40YUhnhywGaJr9z:s7MqklsXzKUwKhyv4T0n1r9z

Score

1^/10

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 4952	2172	rundll32.exe	82
PID 2172 wrote to memory of 4952	2172	rundll32.exe	82
PID 2172 wrote to memory of 4952	2172	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0014820e823557d18aa94cee8108d6f3_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0014820e823557d18aa94cee8108d6f3_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4952