d834935e508416f7be8d4aacab08fa9318b4f3ad6086a3e747dc09720dc4dfba

Analysis

max time kernel
141s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
15-07-2024 11:38

Target

499d81cec21c1b9135c56da941b9d1a9_JaffaCakes118.dll
Size

221KB
MD5

499d81cec21c1b9135c56da941b9d1a9
SHA1

b998cd05dd5aa0cdf13ca24f11c1b8eaa888c67f
SHA256

d834935e508416f7be8d4aacab08fa9318b4f3ad6086a3e747dc09720dc4dfba
SHA512

4c88073000a9727458cf879f998597bda7fbd9c80c30a9b88b2a0ba1a5d5601d4ba761b68412147280d31b414931a08d8acb4dc52442a8a2b8f56f703bec71db
SSDEEP

6144:hX+lH+os/EhtqWwVlfyiYzcnvKfoFMkRyZf+:0lLcOtqWwDfdYzhCMWyl+

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 2156	2068	rundll32.exe	83
PID 2068 wrote to memory of 2156	2068	rundll32.exe	83
PID 2068 wrote to memory of 2156	2068	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\499d81cec21c1b9135c56da941b9d1a9_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\499d81cec21c1b9135c56da941b9d1a9_JaffaCakes118.dll,#1
  2⤵
  PID:2156