24797b76dba4bd6e3664d33cb8ba1464009656ca0ab2bfc6c555c4dc7f26d410

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
29-04-2024 07:33

Target

07215ee2231a2424358213b94a84c7d4_JaffaCakes118.dll
Size

605KB
MD5

07215ee2231a2424358213b94a84c7d4
SHA1

4efe8b02a7794514d685f0a0b3b5478510dca708
SHA256

24797b76dba4bd6e3664d33cb8ba1464009656ca0ab2bfc6c555c4dc7f26d410
SHA512

09a203c0dd6da63385e9afb68420b16145280c77041f41692c7a242e955a8541638d4d4b092e291de843eef6ac1f309145951fdfa5ef077294e6bb20fbecb50f
SSDEEP

12288:Uvnek1pNlCtNghtoYV22y4zFqvfZ+HDNmFjxUQ43+eT6/4pqbxaSLuwbdu:UNDCtyFz2h+HDNmFjz43KH9abKdu

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4544 wrote to memory of 3920	4544	rundll32.exe	rundll32.exe
PID 4544 wrote to memory of 3920	4544	rundll32.exe	rundll32.exe
PID 4544 wrote to memory of 3920	4544	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\07215ee2231a2424358213b94a84c7d4_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\07215ee2231a2424358213b94a84c7d4_JaffaCakes118.dll,#1
  2⤵
  PID:3920