1545093f6a0a826752d1db534da77dbee8f564d53449e1879159fa1d37b40d3b

Analysis

max time kernel
54s
max time network
66s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 23:36

Target

26a6ee108ed292e5f2d7ad77c2650033_JaffaCakes118.dll
Size

200KB
MD5

26a6ee108ed292e5f2d7ad77c2650033
SHA1

268761134c50d0aef8d758bba990424e8ca75d0f
SHA256

1545093f6a0a826752d1db534da77dbee8f564d53449e1879159fa1d37b40d3b
SHA512

458fa8261288bce14a227a5301298181c4a44b4721fb83665ef2f3c93d7cb72083c0690eaf5ea7b61c08dc79a3d350248ce741f6695accb36d6dc8df084f01a7
SSDEEP

3072:o8SsFWPLMXHokWsGdXEj8TCmnsZIKE5H8QGVIghC+VYk9uoaAbi7MoO09:o8SFYj/YsKKE5H0V3uk91aAbi7K09

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 4704	624	rundll32.exe	80
PID 624 wrote to memory of 4704	624	rundll32.exe	80
PID 624 wrote to memory of 4704	624	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\26a6ee108ed292e5f2d7ad77c2650033_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:624
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\26a6ee108ed292e5f2d7ad77c2650033_JaffaCakes118.dll,#1
  2⤵
  PID:4704