89a84e1377ab42876203022d3a2497dcf8a0841e93549c4e882b0cb04316341d

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16-07-2024 08:50

Target

4d9a285a7dab6d63e57dd7d088077230_JaffaCakes118.dll
Size

76KB
MD5

4d9a285a7dab6d63e57dd7d088077230
SHA1

2507cd637f6013b43f4298927c94cb520e4832fe
SHA256

89a84e1377ab42876203022d3a2497dcf8a0841e93549c4e882b0cb04316341d
SHA512

66f3d856d1829895b54fabcef4fb2786c62237234aa93cf7d6a54267565817be2210bfbeb6db8d664a3ad6f1f61783c73a373e6ff41562dd6e3612c7008c8e4c
SSDEEP

1536:s0m7IwTgP2Q0H1roTVIBwmTdWyWt5sQ7g:sFIYgObrutt5sQ7g

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4068 wrote to memory of 3592	4068	rundll32.exe	83
PID 4068 wrote to memory of 3592	4068	rundll32.exe	83
PID 4068 wrote to memory of 3592	4068	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4d9a285a7dab6d63e57dd7d088077230_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4d9a285a7dab6d63e57dd7d088077230_JaffaCakes118.dll,#1
  2⤵
  PID:3592