1752c964e4df122f027afa6a29e73707c8466f156613f2821512147d96fa31c8

Analysis

max time kernel
93s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04-07-2024 03:17

Target

247213b8b666cd5f64ed027a4adfd146_JaffaCakes118.dll
Size

26KB
MD5

247213b8b666cd5f64ed027a4adfd146
SHA1

cf1f30e616718b4093622773e4922ca7a0a58a55
SHA256

1752c964e4df122f027afa6a29e73707c8466f156613f2821512147d96fa31c8
SHA512

51b0d4685808348b17d7e37e5db126c185f1d81acd5ead5d0e030628ad8a35dc86c6f6c5141a7c197d29ebd193d7e08c0e244c6539c067e3c1f8fa2381ac1b61
SSDEEP

384:J9AHxUSoqujGdKnGQm3K6x8+/8tqRfrCjMAhgxLCJYevcuPB1AWBatnSfQmu:wKSoquyd0GQz10TCjMA6RzUutnSf

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4044 wrote to memory of 3564	4044	rundll32.exe	80
PID 4044 wrote to memory of 3564	4044	rundll32.exe	80
PID 4044 wrote to memory of 3564	4044	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\247213b8b666cd5f64ed027a4adfd146_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\247213b8b666cd5f64ed027a4adfd146_JaffaCakes118.dll,#1
  2⤵
  PID:3564