de347ccd86991ed59a74460d047791a8d2fb2246931ee15d762e3a7898a9803e

Analysis

max time kernel
51s
max time network
61s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 01:51

Target

0be599284cfea94676414e7460938e80_JaffaCakes118.dll
Size

14KB
MD5

0be599284cfea94676414e7460938e80
SHA1

7aaa61a9d9df3556b8e1b6510bf554c3869800dd
SHA256

de347ccd86991ed59a74460d047791a8d2fb2246931ee15d762e3a7898a9803e
SHA512

35893eea4ebc02b3e6889461000e734801124649948d3f57788adb5df1e87264d324b6831cf787ca320039c7e611ca21fec6375c28e4f3e310a639e6c010f61f
SSDEEP

192:WDWEebrNen2UE72ghAFkXDZ5h3/vcNSDubcYjfnxdyy9pjk5QU3WotoMFAX9P:6WEa5e7ghHDZj3ncNOulLyy9pjk2D4+

Score

8^/10

Blocklisted process makes network request 1 IoCs

flow	pid	Process
14	652	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 652	1088	rundll32.exe	81
PID 1088 wrote to memory of 652	1088	rundll32.exe	81
PID 1088 wrote to memory of 652	1088	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0be599284cfea94676414e7460938e80_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0be599284cfea94676414e7460938e80_JaffaCakes118.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:652