de6c40b59dbfae6f8c7693f958797f5d646ca63676e0fc700c6f977a3c89afe6

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 23:26

Target

43ad86b7e5e4161c101888a31d91a59f_JaffaCakes118.dll
Size

23KB
MD5

43ad86b7e5e4161c101888a31d91a59f
SHA1

dcd9fa6ea791ef8d4a735e7285e0981faee640b4
SHA256

de6c40b59dbfae6f8c7693f958797f5d646ca63676e0fc700c6f977a3c89afe6
SHA512

a8cc6df8535474d7e705478dc2e630bcc0125afeb9bbc4b03aeae76ec36ff85228286344f0560bd965d77a99b3214b546d7d39b35428d9695a7d98e6e8558981
SSDEEP

384:XvxfA7SZf2GKIpbZCXno5zEGdQN7bXFr1QHM3mNFX81x:XZuSZ+G2adCXFr1QHM3o81x

Score

1^/10

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
652	Process not Found

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 4348	5036	rundll32.exe	83
PID 5036 wrote to memory of 4348	5036	rundll32.exe	83
PID 5036 wrote to memory of 4348	5036	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\43ad86b7e5e4161c101888a31d91a59f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\43ad86b7e5e4161c101888a31d91a59f_JaffaCakes118.dll,#1
  2⤵
  PID:4348