04673e79560205bb4ae2a78dcbde0e45dea0b31853e0a3ebfd61157192f2b21f

Analysis

max time kernel
93s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 21:26

Target

1c8dfecf1d1c8dd71f591c4a613c2116_JaffaCakes118.dll
Size

76KB
MD5

1c8dfecf1d1c8dd71f591c4a613c2116
SHA1

e81f124ba01fd699c82f6cad9b3706a463874c54
SHA256

04673e79560205bb4ae2a78dcbde0e45dea0b31853e0a3ebfd61157192f2b21f
SHA512

ae9712f7c1dfa7da62e473ae62e99baa7cc0b12d3bb9e95d62feaba64ad63122b359489a5f4ab2f31238801c70631e2faaef50c76b1e56658db5a41a3613047d
SSDEEP

768:hB2OkymtgUbpe3UnuqfZLx0H1wyoTVmd3ZwmTdW1URWTSiB9lbUJDou9Z5bbsUDo:hInFg/2t0H1roTVwZwmTdWy2AhsUkx

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4604 wrote to memory of 5008	4604	rundll32.exe	81
PID 4604 wrote to memory of 5008	4604	rundll32.exe	81
PID 4604 wrote to memory of 5008	4604	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1c8dfecf1d1c8dd71f591c4a613c2116_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1c8dfecf1d1c8dd71f591c4a613c2116_JaffaCakes118.dll,#1
  2⤵
  PID:5008