8fe1501cd0fac9d43c60986484b69a37928c77e5a240b1b11571f8ca12860f25

Analysis

max time kernel
96s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 22:09

Target

438890989b27aa2709d1e6d2360c9f98_JaffaCakes118.dll
Size

112KB
MD5

438890989b27aa2709d1e6d2360c9f98
SHA1

8f9ac8fd7f13030174eeeb9373179ec57c12ee2a
SHA256

8fe1501cd0fac9d43c60986484b69a37928c77e5a240b1b11571f8ca12860f25
SHA512

82d9bdc5db734b96c8ed679fe9cf0bb613ff2993b3654f3d45a9e2ef8174546a49030330d0d97077f61566e2fd0fc19add486a9b5c5d4b1d663ac0cfd5b09751
SSDEEP

3072:xjgOgvOGBdAFp2PDyXJdP+cUa/AYOj+I9yAX1g0uuNmfZOYpWRO:JJX1kRltLyZOY

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 4796	2924	rundll32.exe	83
PID 2924 wrote to memory of 4796	2924	rundll32.exe	83
PID 2924 wrote to memory of 4796	2924	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\438890989b27aa2709d1e6d2360c9f98_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\438890989b27aa2709d1e6d2360c9f98_JaffaCakes118.dll,#1
  2⤵
  PID:4796