630a991022b57971c0d4b8cda6ff121145eb12ffd3c4803d9b6955fe1e26f134

Analysis

max time kernel
144s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14-07-2024 23:18

Target

47366ad0973664d6b201983b13124ec3_JaffaCakes118.dll
Size

340KB
MD5

47366ad0973664d6b201983b13124ec3
SHA1

a9576cf5b7073f742e73c378a68ae41b04f61ea3
SHA256

630a991022b57971c0d4b8cda6ff121145eb12ffd3c4803d9b6955fe1e26f134
SHA512

b0217352d051b567bc360d3070ba0c250afabd396e846ba3d9b3f4fec6e6e256e554d376224d4ad1be6626c24d7c6ce6f5b12d25d0d13f108cd15c4322a510de
SSDEEP

3072:zvA1p08RqEQAIVEd2gG/vNlo0JFx/pANyCm0PQEKR/JnXHWP:z206xWgGxLxWN40PDKR/JnX2P

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 4716	4580	rundll32.exe	83
PID 4580 wrote to memory of 4716	4580	rundll32.exe	83
PID 4580 wrote to memory of 4716	4580	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\47366ad0973664d6b201983b13124ec3_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\47366ad0973664d6b201983b13124ec3_JaffaCakes118.dll,#1
  2⤵
  PID:4716