7e6db27bca230cdbcf7c63fbedde5e8fa2a15f00c22912ec9e8820361e87f9c5

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16/07/2024, 05:31

Target

4cfdd65820b5bb4eebec2fab33455cbd_JaffaCakes118.dll
Size

110KB
MD5

4cfdd65820b5bb4eebec2fab33455cbd
SHA1

e706657227650e58bbe3965f17dc2ba380be9b0f
SHA256

7e6db27bca230cdbcf7c63fbedde5e8fa2a15f00c22912ec9e8820361e87f9c5
SHA512

1fec5c77145056e39efb610ca113197263676e5b2434de020e1bfd54f14b07b2a3ba04bfd649d08bbbe3a077c4c3ab5982ba1412f8d58f623f892f59663d18df
SSDEEP

768:t5eWS1jQ4DCrU8lLJ4JYswOwacxAc2+Tf4v1kQJATetrLAbooR:rNIQ6xiGlXOxA4QAT2+v

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 4728	1828	rundll32.exe	83
PID 1828 wrote to memory of 4728	1828	rundll32.exe	83
PID 1828 wrote to memory of 4728	1828	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4cfdd65820b5bb4eebec2fab33455cbd_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4cfdd65820b5bb4eebec2fab33455cbd_JaffaCakes118.dll,#1
  2⤵
  PID:4728

memory/4728-0-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download