4ab66569359964ec117fdcefac3910f4ac6e7213e0115f254b663068f900d9ca

Analysis

max time kernel
93s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 23:28

Target

43af79ef6b1462a4645449bdfa07df67_JaffaCakes118.dll
Size

64KB
MD5

43af79ef6b1462a4645449bdfa07df67
SHA1

8b6671c277134461f1851409530b12b3de6b1c9f
SHA256

4ab66569359964ec117fdcefac3910f4ac6e7213e0115f254b663068f900d9ca
SHA512

aad9b3eefde29e8bb9021d9ce8d01982b792b76d51123cd32ba79648a2eeb57b847753f12b8832f768cfd84c1c130b3b45be19c7756d743825ad5e429c371266
SSDEEP

768:BHLEjXqOcy48wA+LkoqW8lyTxkw9U2p26wbzC5sdxMjiB9UQgwWHiGOs3q0:BWaC+Ltq1lyTCM8nzN4los60

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 4856	2816	rundll32.exe	83
PID 2816 wrote to memory of 4856	2816	rundll32.exe	83
PID 2816 wrote to memory of 4856	2816	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\43af79ef6b1462a4645449bdfa07df67_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\43af79ef6b1462a4645449bdfa07df67_JaffaCakes118.dll,#1
  2⤵
  PID:4856