7897f07ca1f507a18172bbf1c09c44d42012c587c12ffab2230d85b4f6e3decd

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09-07-2024 16:03

Target

310afae66cc4286412c691fcdd1c14f8_JaffaCakes118.dll
Size

340KB
MD5

310afae66cc4286412c691fcdd1c14f8
SHA1

71750105953dd568027d5612585e909c9b9bca47
SHA256

7897f07ca1f507a18172bbf1c09c44d42012c587c12ffab2230d85b4f6e3decd
SHA512

700970d1a4d94bc0b98b75c4a2ca3a728c22a1999ee35affcef880dba174408ea6bf37eaf1c6f50858afbaa774160be8b1c08b4c07f438a16f9ecfb7cfe6764e
SSDEEP

3072:ZvA1p08RqEQAIVEd2gG/vNlo0JFx/pANyCm0PQEKR/JnXHWP:Z206xWgGxLxWN40PDKR/JnX2P

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4024 wrote to memory of 640	4024	rundll32.exe	82
PID 4024 wrote to memory of 640	4024	rundll32.exe	82
PID 4024 wrote to memory of 640	4024	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\310afae66cc4286412c691fcdd1c14f8_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4024
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\310afae66cc4286412c691fcdd1c14f8_JaffaCakes118.dll,#1
  2⤵
  PID:640