ecb04ce2dde9fe76279c355a6632216492148fe1d90c3d5a11562d0e42b04420

Analysis

max time kernel
51s
max time network
58s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20-06-2024 01:13

Target

01a3f1e8608c31507684226c27092cb3_JaffaCakes118.dll
Size

47KB
MD5

01a3f1e8608c31507684226c27092cb3
SHA1

38cafbe407278b260940a2dce9d504c342e85a21
SHA256

ecb04ce2dde9fe76279c355a6632216492148fe1d90c3d5a11562d0e42b04420
SHA512

91f96295e5262163410f1eb6c57de5c2edf746cc94c6f3c91e3dfd9fc3559966b523873ec387cc49cff94d4d5f9d89cddf5fce566782a7ed271e8e42ecb88dc2
SSDEEP

768:DSnMqulsz6iAA7r4Mqi/AdzCvRlLxA9uk8MAzDhjSWT+6Fy:WnMqulsGiVAZCLCILFy

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 368 wrote to memory of 1928	368	rundll32.exe	82
PID 368 wrote to memory of 1928	368	rundll32.exe	82
PID 368 wrote to memory of 1928	368	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\01a3f1e8608c31507684226c27092cb3_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\01a3f1e8608c31507684226c27092cb3_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1928