d0beebd048434f9a422ae6f6f0b291f18517044e0356ec14e218b9d181263736

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 20:17

Target

0f62fd0f331d07dd8f2a8ef8614b5c09_JaffaCakes118.dll
Size

31KB
MD5

0f62fd0f331d07dd8f2a8ef8614b5c09
SHA1

f62587a68cd03eaec5e7d98b907fe1b1ec203e59
SHA256

d0beebd048434f9a422ae6f6f0b291f18517044e0356ec14e218b9d181263736
SHA512

49e6ba9e73e8af431bc4dd6bb05a128071f74783240ca320456e17844288e4a9def7bcda501df4b09ae3922a53ab2a8d1e5a63c8a7b37ba1547b98d86ae3d490
SSDEEP

768:mV4wxeKkrmbzw37oYD7C/pH8AKghqD2RJXzA:mV4wxehSw397C/dDkqRJjA

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 3064	1632	rundll32.exe	84
PID 1632 wrote to memory of 3064	1632	rundll32.exe	84
PID 1632 wrote to memory of 3064	1632	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f62fd0f331d07dd8f2a8ef8614b5c09_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f62fd0f331d07dd8f2a8ef8614b5c09_JaffaCakes118.dll,#1
  2⤵
  PID:3064