cb6dd8c2b6a91f3bd08394117a40f34e05e5d7990f371dcb83acfd8d732eb227

Analysis

max time kernel
80s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25-06-2024 05:31

Target

0ccd44aaeba7fe97d77716c241523dd6_JaffaCakes118.dll
Size

23KB
MD5

0ccd44aaeba7fe97d77716c241523dd6
SHA1

542ab0ca7a17c57efe2637318309374b9ae9bf09
SHA256

cb6dd8c2b6a91f3bd08394117a40f34e05e5d7990f371dcb83acfd8d732eb227
SHA512

b9c8cfc1da2d3347f29badd8b95f603b2d853f7c2278afb9e1a13f5e9f817e56ae8a8024da30f34239732771cc0c81577cdb9f4ba7816f90e07a54d9b80cf824
SSDEEP

384:ZUARcT6YoGh03fSKtii+PgN4fZinI9g5fKL72sjAuAeHIVfuGPjTx3m:Z9RN3fT8i+oN4wnH0lVxHet1

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4584 wrote to memory of 1504	4584	rundll32.exe	80
PID 4584 wrote to memory of 1504	4584	rundll32.exe	80
PID 4584 wrote to memory of 1504	4584	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ccd44aaeba7fe97d77716c241523dd6_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ccd44aaeba7fe97d77716c241523dd6_JaffaCakes118.dll,#1
  2⤵
  PID:1504