c01754436094802ccc48035a8679bf1f681ed6b20eb16a27cb796ba15eb8f628

Analysis

max time kernel
140s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 03:12

Target

0c3b8e974e0bb8c6f185e4e6574c69e6_JaffaCakes118.dll
Size

117KB
MD5

0c3b8e974e0bb8c6f185e4e6574c69e6
SHA1

6fef9d2f5cf2e2b720cf7dd9c91dece3978d4294
SHA256

c01754436094802ccc48035a8679bf1f681ed6b20eb16a27cb796ba15eb8f628
SHA512

ea5559c58b3f663d3524c499e5c2ba4a866acea9ce4d0b75a4215d1d218c9f4ba191a093154f9ca56f89ee13ac097790bfc2148d83a93b9814fbe3dd4a601147
SSDEEP

3072:NiA9nEuBFV1kxtMmsF4LlPBHapqJbCTEhzOX0SkM2Qro7QyjQLxovpT/n60IEt:nE0msuL1UqzQro7QyjQypbT

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4252 wrote to memory of 4384	4252	rundll32.exe	85
PID 4252 wrote to memory of 4384	4252	rundll32.exe	85
PID 4252 wrote to memory of 4384	4252	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c3b8e974e0bb8c6f185e4e6574c69e6_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4252
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c3b8e974e0bb8c6f185e4e6574c69e6_JaffaCakes118.dll,#1
  2⤵
  PID:4384

memory/4384-0-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download