4e4e92c260ac7c561f2d5529044a71f126215a314d3ad39781d269fabd5193c5

Analysis

max time kernel
94s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 00:43

Target

2a619c8be322908172e19dbf9cafdf7f_JaffaCakes118.dll
Size

72KB
MD5

2a619c8be322908172e19dbf9cafdf7f
SHA1

93e1bdadfdd9f8614291114c3afe0df501dce61c
SHA256

4e4e92c260ac7c561f2d5529044a71f126215a314d3ad39781d269fabd5193c5
SHA512

27232e2d464fcbff512cea27efd188ed01d4c6ec33e51892d1b949dd17d83fa0510c78eaf14d9dd81b67045a03339126ead6b0cc65d0337fb472437b03e82b10
SSDEEP

1536:n0tEuvO/PDIPYURsJT7YA+rI89PbGXxHQLToAzbSh:nuEuvO/g9RsW33SHkToQbS

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3328 wrote to memory of 4868	3328	rundll32.exe	82
PID 3328 wrote to memory of 4868	3328	rundll32.exe	82
PID 3328 wrote to memory of 4868	3328	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a619c8be322908172e19dbf9cafdf7f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3328
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a619c8be322908172e19dbf9cafdf7f_JaffaCakes118.dll,#1
  2⤵
  PID:4868