6c7926eb46ffadd2e9d6013171518898105208ab5e26c83f758778f95d3f92ec

Analysis

max time kernel
135s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 13:50

Target

06932eaa5ea0d84e7f9ac4033d14ae8b_JaffaCakes118.dll
Size

131KB
MD5

06932eaa5ea0d84e7f9ac4033d14ae8b
SHA1

99ab40a63ec64e887338655f83e32e53b3810ef9
SHA256

6c7926eb46ffadd2e9d6013171518898105208ab5e26c83f758778f95d3f92ec
SHA512

65f6a7a6dd92fb00db4fd5cbf3dad4416e67b32b23841bc20446c060658b88822ce741f9ebc860a5853b6c26e80dd3152aa9da78410ca8db076a5c7aea43c1b6
SSDEEP

768:VMpEeVtWtMElOxIe6annGTDBDh4h9wWJpfUx:25V8agOzOBDh4hLUx

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 2772	2656	rundll32.exe	85
PID 2656 wrote to memory of 2772	2656	rundll32.exe	85
PID 2656 wrote to memory of 2772	2656	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\06932eaa5ea0d84e7f9ac4033d14ae8b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\06932eaa5ea0d84e7f9ac4033d14ae8b_JaffaCakes118.dll,#1
  2⤵
  PID:2772