244d4efd367d72b9bc715d6973359ee6f01d1a5bae609e8a09c90b5962880467

Analysis

max time kernel
92s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2024, 01:46

Target

ac77fc4a2dc31be1b9c66cef27544c38_JaffaCakes118.dll
Size

1.1MB
MD5

ac77fc4a2dc31be1b9c66cef27544c38
SHA1

40049a0a48ed15d67113406755aad07b1fde2c87
SHA256

244d4efd367d72b9bc715d6973359ee6f01d1a5bae609e8a09c90b5962880467
SHA512

0bc0796b66768a47812774567e32fe092449f33cb5df7f8a2a81a437ff0cab097688de0160d32286410c86e1921cbbdaa0ed587c36ce6d93a594fa6b9e81c602
SSDEEP

24576:QvMLiQo6db9CwJuu+pS0+M3tb0pvaep5ZGm1an:lLizrwou/0J3tCieD7an

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3716 wrote to memory of 380	3716	rundll32.exe	84
PID 3716 wrote to memory of 380	3716	rundll32.exe	84
PID 3716 wrote to memory of 380	3716	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ac77fc4a2dc31be1b9c66cef27544c38_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ac77fc4a2dc31be1b9c66cef27544c38_JaffaCakes118.dll,#1
  2⤵
  PID:380