48b7b00dd539026fe193d5f239b73463a0fc24c5686379162fbe85ac1aabbf03

Analysis

max time kernel
135s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
25-06-2024 05:07

Target

0cb29ffc62df134b20b8952b0a1627c2_JaffaCakes118.dll
Size

560KB
MD5

0cb29ffc62df134b20b8952b0a1627c2
SHA1

0b05111dda7ff96f8cb6fa5aeb62eb909f72f387
SHA256

48b7b00dd539026fe193d5f239b73463a0fc24c5686379162fbe85ac1aabbf03
SHA512

b778a27ec8da6265dadfa93cd9335e4ff2017436b81988d207370cfdf088054ff884d7021e3260a4b50fa8b90e8965f900f21a5a24440d809c89da6201552cca
SSDEEP

12288:SSDlVvts7o4hmytTkAM2Bi90ulk+Zosfvz1IqmrE6UCYFS:Lvts7o4Rw/2Bwqsfvz1IqmA6K

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1176 wrote to memory of 3696	1176	rundll32.exe	84
PID 1176 wrote to memory of 3696	1176	rundll32.exe	84
PID 1176 wrote to memory of 3696	1176	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0cb29ffc62df134b20b8952b0a1627c2_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0cb29ffc62df134b20b8952b0a1627c2_JaffaCakes118.dll,#1
  2⤵
  PID:3696