d6075fcbebc1be86a7eef108372394ed6fe3bc6c3d7d711d61f839b074aa55b6

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 19:23

Target

0a64700fffb73c78e53aef5d59fb1bcb_JaffaCakes118.dll
Size

110KB
MD5

0a64700fffb73c78e53aef5d59fb1bcb
SHA1

07bb77efe635f17d1ee094143a40476e9174397d
SHA256

d6075fcbebc1be86a7eef108372394ed6fe3bc6c3d7d711d61f839b074aa55b6
SHA512

5e35f93dc896f4185e1ced3101cf4622a670e367fa658bb632bfe1a5808d5353b492dd53e824e528a38fb7471b1f44e17ace5eb9a00275df428e97c9e401fa3b
SSDEEP

3072:cmwEHYkE0EHTw6HP2qinb/0lQSL+cdstVwu9+WgFT9:xHY9UYbcE+cdstVwu5

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 924 wrote to memory of 4444	924	rundll32.exe	81
PID 924 wrote to memory of 4444	924	rundll32.exe	81
PID 924 wrote to memory of 4444	924	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0a64700fffb73c78e53aef5d59fb1bcb_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0a64700fffb73c78e53aef5d59fb1bcb_JaffaCakes118.dll,#1
  2⤵
  PID:4444