c4913c6ef13c1a9deb84084224b496b83879862f045acd1edb56f9361a33bf50

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 00:28

Target

0593026fd1233dcc69377ca69337afde_JaffaCakes118.dll
Size

649KB
MD5

0593026fd1233dcc69377ca69337afde
SHA1

aa379711a05cbd96000bafdcabd0879c223ef38c
SHA256

c4913c6ef13c1a9deb84084224b496b83879862f045acd1edb56f9361a33bf50
SHA512

1a2c52c17e9ab7d3cde88ffeb8c301186250c0e04c5054639f469b7c250dea257bb1d063587c376e78889af588d85d300ffbcea2e03e2ddfd4f4cd9ffc6afac0
SSDEEP

12288:g8TzPGFLjWdE4hrndQ2StZIzZkBhoQt7jv1/aT2RMkXN:zTy5oEcndQ2S/IzGkIv1iTuMkXN

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 1596	2508	rundll32.exe	81
PID 2508 wrote to memory of 1596	2508	rundll32.exe	81
PID 2508 wrote to memory of 1596	2508	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0593026fd1233dcc69377ca69337afde_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0593026fd1233dcc69377ca69337afde_JaffaCakes118.dll,#1
  2⤵
  PID:1596