998c36ae5a777074ae8fdffd60b6b41d98e9ca6682f3f3a3cfd27b66f8d26808

Analysis

max time kernel
146s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16-07-2024 08:13

Target

4d7c80e26ea5bb818f51e25b9cb31edb_JaffaCakes118.dll
Size

347KB
MD5

4d7c80e26ea5bb818f51e25b9cb31edb
SHA1

dcd7a7cefeff0c843b7d438f00c40a3ee5f007a9
SHA256

998c36ae5a777074ae8fdffd60b6b41d98e9ca6682f3f3a3cfd27b66f8d26808
SHA512

78f3088ba5e129dfe63f6dbbb9eeccc5dcd903324750ddfcab1d9a3c98eceef8dc4700e5e3b09222dfe055d423fdaac7e6562684d8892d63d91f33550e25a2b5
SSDEEP

6144:HYz/VGZI9uh7zjXcmYEtGIBrSaR5PmtqWNG42HTWUncAWe7gpko8dJpQo1aaUW6C:Hwnu1IaSk6vqJpT7U

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 2536	4580	rundll32.exe	83
PID 4580 wrote to memory of 2536	4580	rundll32.exe	83
PID 4580 wrote to memory of 2536	4580	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4d7c80e26ea5bb818f51e25b9cb31edb_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4d7c80e26ea5bb818f51e25b9cb31edb_JaffaCakes118.dll,#1
  2⤵
  PID:2536