f8f67b070e5d0574928ccc3a78f5cb2e61042eaf3080b728cb4734329a1e8fb3

Analysis

max time kernel
112s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 08:40

Target

490998f7e0956e394fd0800e62ea696b_JaffaCakes118.dll
Size

32KB
MD5

490998f7e0956e394fd0800e62ea696b
SHA1

6e708ff3bc22e2875ee9673e44a4bb224e36617f
SHA256

f8f67b070e5d0574928ccc3a78f5cb2e61042eaf3080b728cb4734329a1e8fb3
SHA512

3967ff90f2c5797801cb88cd79e48e8d119510692c3b980ff1b1f3a63a42c23e555f7ed6b7f5646758eda6ae001e81ef8536fd14ad4bdaab5141213f243e792e
SSDEEP

384:Eopf1ZC9c9ovkDnmFnK2eYpHfC78pxZs772qm+HoLq00dO0Baw7JFJ5CRkEn0C7:EUf3GvbnneYpq74s70VqboShVDMRk60K

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 852	1640	rundll32.exe	83
PID 1640 wrote to memory of 852	1640	rundll32.exe	83
PID 1640 wrote to memory of 852	1640	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\490998f7e0956e394fd0800e62ea696b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\490998f7e0956e394fd0800e62ea696b_JaffaCakes118.dll,#1
  2⤵
  PID:852