7fa3c6cdd9adc510cbebd4f02e52a29dd70b02eb291a680c859147bbd266cca5

Analysis

max time kernel
92s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 20:59

Target

1c7a40dfb710269866d3ae953cbb8729_JaffaCakes118.dll
Size

51KB
MD5

1c7a40dfb710269866d3ae953cbb8729
SHA1

e8e6c854d921bec2708fbed334b1d2073449533d
SHA256

7fa3c6cdd9adc510cbebd4f02e52a29dd70b02eb291a680c859147bbd266cca5
SHA512

f1daadd297b91c0c7222dc3b8dcff11e73ca4624638137041337e6cf34001f275ed0e06dafa8549b97571b7e68989bd214596610a7e545c55f3c13b8f89fdceb
SSDEEP

768:k4I+2CNsWE3T+qF8MlY5dmHfZ4kaPbuq2S/jNa:k4IrkE3TZB0duqb/j

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4196 wrote to memory of 4680	4196	rundll32.exe	81
PID 4196 wrote to memory of 4680	4196	rundll32.exe	81
PID 4196 wrote to memory of 4680	4196	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1c7a40dfb710269866d3ae953cbb8729_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1c7a40dfb710269866d3ae953cbb8729_JaffaCakes118.dll,#1
  2⤵
  PID:4680