b0315274102cbc67ca2108f9d291e7d6c4f75edfcddfc473131d3409191ec9a3

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 16:34

Target

0ec54085f683193f603ee23cb59fd623_JaffaCakes118.dll
Size

97KB
MD5

0ec54085f683193f603ee23cb59fd623
SHA1

6628c570f11bf0566e5a036919eee9a0ca9ad3fa
SHA256

b0315274102cbc67ca2108f9d291e7d6c4f75edfcddfc473131d3409191ec9a3
SHA512

86706ee6812c9edb5d63d0923b8721aa8b48f7c2a1712845d50d1413e99bcfec8026c2359131ab7909b1a4c2b3bcb0a377bd9e2327272efc711f6a23256e5775
SSDEEP

1536:emmK3vuWub155eAnw4kj5pFvJc4YM0uNPt8rwZkPg/1sV:jh3Rq1eywbj5/xdYDWVZKIs

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 1792	1876	rundll32.exe	80
PID 1876 wrote to memory of 1792	1876	rundll32.exe	80
PID 1876 wrote to memory of 1792	1876	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ec54085f683193f603ee23cb59fd623_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ec54085f683193f603ee23cb59fd623_JaffaCakes118.dll,#1
  2⤵
  PID:1792

memory/1792-0-0x0000000040000000-0x000000004001C000-memory.dmp

Filesize
112KB

Download