d54a18e2eca0c4b86e33c510c3a230ba6a74657e9ac4a98a79c0007a6de97f57

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 01:04

Target

0baee913b0674d190a68571d59237241_JaffaCakes118.dll
Size

44KB
MD5

0baee913b0674d190a68571d59237241
SHA1

4aa6323ee3ba5e02d17c65b6f0139f8f89823602
SHA256

d54a18e2eca0c4b86e33c510c3a230ba6a74657e9ac4a98a79c0007a6de97f57
SHA512

ae17857c3616247d989088b6230f3cb951e5bb39eb81bcffdcfdcda72124029762127f68251ec8e18bf95be641db6a3460631a1a0fd854641680ed9df99d0823
SSDEEP

768:3AZmRe78WL0PoYWd0ICoGCYQQNBXpXH7M9EGpc+xBBQARQkcUmhHAM2n:3XeQSFdgGpc+xBBQARMUQS

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3500 wrote to memory of 1060	3500	rundll32.exe	80
PID 3500 wrote to memory of 1060	3500	rundll32.exe	80
PID 3500 wrote to memory of 1060	3500	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0baee913b0674d190a68571d59237241_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3500
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0baee913b0674d190a68571d59237241_JaffaCakes118.dll,#1
  2⤵
  PID:1060