4b4114eebb477444603b8db09d7344438a662b3eb0b58e09c505588c3981eb96

Analysis

max time kernel
92s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 16:05

Target

4a6651772429e5598b81e6772bf7a917_JaffaCakes118.dll
Size

45KB
MD5

4a6651772429e5598b81e6772bf7a917
SHA1

2c250e7f953a4864f84f8c485c65b3b7ea51676d
SHA256

4b4114eebb477444603b8db09d7344438a662b3eb0b58e09c505588c3981eb96
SHA512

9e573d9c4a45e9e5886c0c623e92172f7f3647c351f1e4fb0fe5e40a26d6ab68ebb7e310164a5adce7d8f99f90d4acc145ef661414f81caf8c5451f19f63b566
SSDEEP

768:OIlD7pwp107alMyepbRTaT34Zx7pckNLw5zHJKiu2iU5ynOuotyc:RV8/mFTAoZLcTJKiknOByc

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 180	2348	rundll32.exe	83
PID 2348 wrote to memory of 180	2348	rundll32.exe	83
PID 2348 wrote to memory of 180	2348	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4a6651772429e5598b81e6772bf7a917_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4a6651772429e5598b81e6772bf7a917_JaffaCakes118.dll,#1
  2⤵
  PID:180