1fd6c1118782d0f2666bec2c12c702b93564e06a39cbf833debae7d6b6cf2e8a

Analysis

max time kernel
134s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 17:35

Target

84ec7a48992273c77b0df743a1754706_JaffaCakes118.dll
Size

74KB
MD5

84ec7a48992273c77b0df743a1754706
SHA1

965be9c463ca92da852a811dd929a01dd89f0891
SHA256

1fd6c1118782d0f2666bec2c12c702b93564e06a39cbf833debae7d6b6cf2e8a
SHA512

e732e707b2cdeb8a2190e146f187c752358b6f489846bbe183c596b5b00384f604e5920df0283e109fadbfd6c35d0d2b456324815fa2ca14f550ae38f98d293c
SSDEEP

1536:B/7tY+plsUPpUb+ZLj5sDDqGMR9IzEqgNXJ8CzomJzl+nWfrdIAwixajFZo+dXUY:BDW+plsUwoLj2DDi927gHbBlFdfwi4JJ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3784 wrote to memory of 3988	3784	rundll32.exe	82
PID 3784 wrote to memory of 3988	3784	rundll32.exe	82
PID 3784 wrote to memory of 3988	3784	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\84ec7a48992273c77b0df743a1754706_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3784
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\84ec7a48992273c77b0df743a1754706_JaffaCakes118.dll,#1
  2⤵
  PID:3988