06489dd9eab9657fa9e4efd5dc243047500133662c5c21b787fd8b7c6b8d491b

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 11:11

Target

458f738b0919d165ffa29f475ddd7a2c_JaffaCakes118.dll
Size

76KB
MD5

458f738b0919d165ffa29f475ddd7a2c
SHA1

418e62aced26b0edf555215f7691ed13367909ec
SHA256

06489dd9eab9657fa9e4efd5dc243047500133662c5c21b787fd8b7c6b8d491b
SHA512

6a58475d8de60be1f63c363916a5c9af5300b383e06cc1d9f48e0e8fd6319e0a97bfaed161badb03bee59a72fa9de95d2cfb4e0838039858f8322e6660a87753
SSDEEP

768:ZHPF9c2tgipe3Un+afZIx0H1wyoTVmdHBwmTdW1URWTCiB9VbU5DoLVZ5bbs6DiE:BPbTgP2Q0H1roTVIBwmTdWyWt5s6WE

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 2268	4840	rundll32.exe	83
PID 4840 wrote to memory of 2268	4840	rundll32.exe	83
PID 4840 wrote to memory of 2268	4840	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\458f738b0919d165ffa29f475ddd7a2c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\458f738b0919d165ffa29f475ddd7a2c_JaffaCakes118.dll,#1
  2⤵
  PID:2268