51ab0ecc7042f52dcd1eb00bcb6cbda3402d9ec260d03834fb8d502295f36299

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 00:13

Target

18138ba857b9ec2ebfadcf32d60e7cb1_JaffaCakes118.dll
Size

280KB
MD5

18138ba857b9ec2ebfadcf32d60e7cb1
SHA1

31a4fdf2e36072221a60d6d2b6e322e5e63c0df1
SHA256

51ab0ecc7042f52dcd1eb00bcb6cbda3402d9ec260d03834fb8d502295f36299
SHA512

a2ceb659beac9869cd5571e061bc674863cd32ec5b2cd38abce0d07d5aa5d2a1bf4ec711ec6034915ae3708dafdbc0185347c43d6a98d745a4faaf9daeb708a9
SSDEEP

3072:cY7UqpyNzetmNFCd46R5Pk00/ILaps6s7yVeH4lqwRJMd2Du15urWuKSXq1vvtL1:vgNrFG46fk9+oxUh1

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 2304	2556	rundll32.exe	81
PID 2556 wrote to memory of 2304	2556	rundll32.exe	81
PID 2556 wrote to memory of 2304	2556	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\18138ba857b9ec2ebfadcf32d60e7cb1_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\18138ba857b9ec2ebfadcf32d60e7cb1_JaffaCakes118.dll,#1
  2⤵
  PID:2304