9818ca9c60172cbf6ccd8d99e795649b1af6b0385195411e3f1337e4fbd47af7

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 10:18

Target

0516a329ba36802a69ec9e2d9082c283_JaffaCakes118.dll
Size

33KB
MD5

0516a329ba36802a69ec9e2d9082c283
SHA1

aaf63a3f0ce810f3d61c21434a9ae58b6f2d8810
SHA256

9818ca9c60172cbf6ccd8d99e795649b1af6b0385195411e3f1337e4fbd47af7
SHA512

6c514761cfe81e01bd6500dd149fddebec0b00c4914913168c8104ce6a58ee2b666b286d43f0ff87c91e0e8de0b9523425c4d49f0abed8a4838b65a239cb5f33
SSDEEP

768:RttZ9W5aYyJQcwmCytRQEfvZgDJZ4P2I0AKx:RTZ95YyKRty/Yfi

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 756	2488	rundll32.exe	81
PID 2488 wrote to memory of 756	2488	rundll32.exe	81
PID 2488 wrote to memory of 756	2488	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0516a329ba36802a69ec9e2d9082c283_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0516a329ba36802a69ec9e2d9082c283_JaffaCakes118.dll,#1
  2⤵
  PID:756