ea93c00a5643f1ae97fc7542f40b3600a8ee408d82dfe0c3bb20fb1c9e5e830c

Analysis

max time kernel
139s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
25-06-2024 11:49

Target

0df460465b08b55e722036040f27db6c_JaffaCakes118.dll
Size

320KB
MD5

0df460465b08b55e722036040f27db6c
SHA1

7fbd5bb387c63e2e1fadf8df02614b6bcbffcc66
SHA256

ea93c00a5643f1ae97fc7542f40b3600a8ee408d82dfe0c3bb20fb1c9e5e830c
SHA512

4f94a1d40fbfa7043cf222dcf70ab6e2302d8fb88348556ad5cdf6b53c61c91bc559f4b661d2f7c3f7e21d8ad585c893a52fd2f627bd7dde1a1f863272b1729b
SSDEEP

3072:PA6Rs2UDyjCQWUZJwPoakFD0JJCOfgwmyx99QJa/pRJeyGKhnNKYAWL7ChtxKCw4:/s1y5W7PlQWfgwmAncOkb1

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 2388	4436	rundll32.exe	83
PID 4436 wrote to memory of 2388	4436	rundll32.exe	83
PID 4436 wrote to memory of 2388	4436	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0df460465b08b55e722036040f27db6c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0df460465b08b55e722036040f27db6c_JaffaCakes118.dll,#1
  2⤵
  PID:2388