cd515cf75d95083c0e0602b20d60bd6ed4b7a3c09b11356368380b781b02f642

Analysis

max time kernel
140s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 08:13

Target

0446e23fab9f36663d3facaaf02b45bf_JaffaCakes118.dll
Size

32KB
MD5

0446e23fab9f36663d3facaaf02b45bf
SHA1

1d716fb79ebc42a3124021c7a05136ed3e696924
SHA256

cd515cf75d95083c0e0602b20d60bd6ed4b7a3c09b11356368380b781b02f642
SHA512

eb868d7d5ad4561aedcf1e218e0e9eaa79fed7dc30ecb7bf0fa158d8f2d820284fa88ac4e7989332dd5937ccf44a6b7899058c8f04ed4dadab3564ae0ae31304
SSDEEP

384:sgIl2jwtnEFG8tkvxj5NpSDkDpEgOUGKJtoDqK:cnEFG8tkJlNpSDkDpE7KJtoDq

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3112 wrote to memory of 1420	3112	rundll32.exe	82
PID 3112 wrote to memory of 1420	3112	rundll32.exe	82
PID 3112 wrote to memory of 1420	3112	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0446e23fab9f36663d3facaaf02b45bf_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3112
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0446e23fab9f36663d3facaaf02b45bf_JaffaCakes118.dll,#1
  2⤵
  PID:1420