93502b5fcb8ad5817a86e0adf6222f7d8b8d45c73738f2c0266b79cc715974e6

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 11:17

Target

347ecf124a763bb44f6d20c87926e2c0_JaffaCakes118.dll
Size

1.6MB
MD5

347ecf124a763bb44f6d20c87926e2c0
SHA1

d507a8da70ac4905e41fde498c6957784b31a75e
SHA256

93502b5fcb8ad5817a86e0adf6222f7d8b8d45c73738f2c0266b79cc715974e6
SHA512

217fa26a6936681efb4535752fd4a911bd2f6e08baacb5a8ecf95c26fde15e83fa9194a7c2377351a75040c6b0cb49452db9b1f9b7a82ef4113e6c9ceab927c9
SSDEEP

24576:i3ySWAQKCkzx2jMcRimnUNdqYpJ9Q28c/vKTHOTn/lRSLSVoNjsV8esiZk1y7LTB:HZA3ldPP9QvTuTam/PLT46EDzcZ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4220 wrote to memory of 5012	4220	rundll32.exe	81
PID 4220 wrote to memory of 5012	4220	rundll32.exe	81
PID 4220 wrote to memory of 5012	4220	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\347ecf124a763bb44f6d20c87926e2c0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\347ecf124a763bb44f6d20c87926e2c0_JaffaCakes118.dll,#1
  2⤵
  PID:5012