0c6eba4815b80e83f908208d80df0142e960d38904ef9cebe718d1c0bd89ccc6

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 12:02

Target

5bdaf23675c065e4bfed63fae0a01379_JaffaCakes118.dll
Size

137KB
MD5

5bdaf23675c065e4bfed63fae0a01379
SHA1

53d2997dc3359a78de761c748c4054b7f14ba015
SHA256

0c6eba4815b80e83f908208d80df0142e960d38904ef9cebe718d1c0bd89ccc6
SHA512

7b9b9b5c50dde6b92591f6d9df858af9a356c4a2fab4c1dd5dce4e07fadb96f045f7ec8b9d832d0b452f2639597a46c5688bf383f3b56dc121835e934daef8e1
SSDEEP

3072:8BhE7pCpDPT8iqc1OBWtaMm9i8WSeNm+U7lDhX9z:8BhMp8Dgiq5M2W74xhtz

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 4104	4956	rundll32.exe	84
PID 4956 wrote to memory of 4104	4956	rundll32.exe	84
PID 4956 wrote to memory of 4104	4956	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5bdaf23675c065e4bfed63fae0a01379_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5bdaf23675c065e4bfed63fae0a01379_JaffaCakes118.dll,#1
  2⤵
  PID:4104