6b3b3bdda9f9e19146abd8e417b6b5a995e525f31eedf88d83f1734ea0832daa

Analysis

max time kernel
94s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 11:30

Target

5bc1bc055910af75539ce07266b6a42e_JaffaCakes118.dll
Size

28KB
MD5

5bc1bc055910af75539ce07266b6a42e
SHA1

b7ebce0a8b23bf53ae3054ff510e0f7b3a108402
SHA256

6b3b3bdda9f9e19146abd8e417b6b5a995e525f31eedf88d83f1734ea0832daa
SHA512

ebcee855fc97eb0edf6054239e38de9f015b638f854aaab109419409e7a88a0a87af199de85e07dd901baa130fc561a6b6e50db491e39c6bff36399ecf76390d
SSDEEP

384:j0HFnc6irjeXH8y4PmPqhP9TZKoK73jJk:jEFtif+4PmPqhP917Kbje

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 3676	2600	rundll32.exe	86
PID 2600 wrote to memory of 3676	2600	rundll32.exe	86
PID 2600 wrote to memory of 3676	2600	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5bc1bc055910af75539ce07266b6a42e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5bc1bc055910af75539ce07266b6a42e_JaffaCakes118.dll,#1
  2⤵
  PID:3676