a46d5ac4c079b155480f5199098909267eac0b27f1f215254d713cb84dafda17

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 11:53

Target

0df7a71a7b8fa8b824b79012ea74036c_JaffaCakes118.dll
Size

36KB
MD5

0df7a71a7b8fa8b824b79012ea74036c
SHA1

66503a37d08f8a672f94c0fa6b94e4c98a9a30a7
SHA256

a46d5ac4c079b155480f5199098909267eac0b27f1f215254d713cb84dafda17
SHA512

3a7091ea31bedead1a0f49ef4f115d497c982eaa61858376c5edf3c0bee486e465b42e160ba67869542e0a0473762cc8764fc9bac49232eaf92dc22a3d79a8d5
SSDEEP

768:Go53hJbyNbNON0lQwuXgcR1pV7Oq7Kj95hNDRR0VAZlVq:txByNbN+eqgcRF7V7YvdR0VAzI

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 64 wrote to memory of 2324	64	rundll32.exe	81
PID 64 wrote to memory of 2324	64	rundll32.exe	81
PID 64 wrote to memory of 2324	64	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0df7a71a7b8fa8b824b79012ea74036c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:64
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0df7a71a7b8fa8b824b79012ea74036c_JaffaCakes118.dll,#1
  2⤵
  PID:2324