67654ae2c2dfe18dfbb89656a2ec978ab91a444e2a538153b8a217d4526498d2

Analysis

max time kernel
92s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 20:16

Target

432fd227d558775fb563ae28f061f81d_JaffaCakes118.dll
Size

300KB
MD5

432fd227d558775fb563ae28f061f81d
SHA1

c41098c5738a87e86fbda6976cb1a3e30a10315a
SHA256

67654ae2c2dfe18dfbb89656a2ec978ab91a444e2a538153b8a217d4526498d2
SHA512

489e51777d1858f7d5cc8d8bd847a45e0dbdcbc4165ec9ff50b73a088dcc3c440edc7d36a68b435b5219d20573914c7b8a170f418b0ef657097ed3b43a153cf5
SSDEEP

6144:uS430SXoJ/RGWQonopBwj/mgGdbVHl6x3SttMx5XtAODB:l7E7a/AvHl6OMfd

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 4112	5064	rundll32.exe	83
PID 5064 wrote to memory of 4112	5064	rundll32.exe	83
PID 5064 wrote to memory of 4112	5064	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\432fd227d558775fb563ae28f061f81d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\432fd227d558775fb563ae28f061f81d_JaffaCakes118.dll,#1
  2⤵
  PID:4112