417595a8f2c0337c0677be310d6da9032892f1638cc645cd427cf314f0e9af70

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 17:53

Target

09f6c0768d4454e3521ff8cbeeba24df_JaffaCakes118.dll
Size

160KB
MD5

09f6c0768d4454e3521ff8cbeeba24df
SHA1

3258c71ad4487c6650567e3e0a8232f92ca43d6b
SHA256

417595a8f2c0337c0677be310d6da9032892f1638cc645cd427cf314f0e9af70
SHA512

6531d0f09f509ce80ed7fd245267d4d93b0c19ba7c8f636617c04acebcac4c47fb6d2621686c97973213cd5b24a67e699769acfec46ab7aa2fc30985a896cab9
SSDEEP

3072:/gELDuMDp/FA8urs0oGJsdTztRF3vmY+VTjGeyCwO4FbU/CGKI7K:t/FtusGJslztRF3vmY+VTjGJCwOwl

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 532 wrote to memory of 2448	532	rundll32.exe	81
PID 532 wrote to memory of 2448	532	rundll32.exe	81
PID 532 wrote to memory of 2448	532	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\09f6c0768d4454e3521ff8cbeeba24df_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:532
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\09f6c0768d4454e3521ff8cbeeba24df_JaffaCakes118.dll,#1
  2⤵
  PID:2448