7c0458c80ad688b8359610b26b8020acd5a6da2ba58cadeca4a9654d0f537524

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 12:13

Target

1a1255038895810905726270bce57294_JaffaCakes118.dll
Size

200KB
MD5

1a1255038895810905726270bce57294
SHA1

3470fab7a262b4784fb773e8c8ef15702fcd6024
SHA256

7c0458c80ad688b8359610b26b8020acd5a6da2ba58cadeca4a9654d0f537524
SHA512

5629abddf822f60043a465e099e38976346c4adefa77a640a2adcaabe836199f9fef8395524ef0bafe8b7356cb4cbeefd0029a9716d64be09dc7e0c2f7f3fa04
SSDEEP

3072:kSCMqmC9p0paDKJskWnYXpiL3AWXkDSL9rF5DN1H9Bw1+A9xZH/A:5LbsRKmfYQL3A7SL9r7pBwYA9xZ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 2604	4872	rundll32.exe	81
PID 4872 wrote to memory of 2604	4872	rundll32.exe	81
PID 4872 wrote to memory of 2604	4872	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a1255038895810905726270bce57294_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a1255038895810905726270bce57294_JaffaCakes118.dll,#1
  2⤵
  PID:2604