19fd1e0d0314c1e10627c85238bc91d65f85e1e44ecead59a7532b5758e01a89

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 10:43

Target

0dc58a1783445541ecbdb2ef56e73744_JaffaCakes118.dll
Size

98KB
MD5

0dc58a1783445541ecbdb2ef56e73744
SHA1

298ad1629cbec522655f48490fb98ba6ef1f394c
SHA256

19fd1e0d0314c1e10627c85238bc91d65f85e1e44ecead59a7532b5758e01a89
SHA512

e47f9163d1845e1330ddfa81ff2870175f9f689d3671a3bd402690d6d48909933ff0af9ad5176307efdbdf2a9f0c9b26d3e04cacba80ed24c5c2b40e134c83b1
SSDEEP

3072:tNamVdj18/IWQ80cABPJXA2HdagXfkTFC:pVd58/FQ8XANJXA29VkhC

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3528 wrote to memory of 1508	3528	rundll32.exe	83
PID 3528 wrote to memory of 1508	3528	rundll32.exe	83
PID 3528 wrote to memory of 1508	3528	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0dc58a1783445541ecbdb2ef56e73744_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3528
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0dc58a1783445541ecbdb2ef56e73744_JaffaCakes118.dll,#1
  2⤵
  PID:1508