b4a1483f78bfc8a3d5c03e30fb3b3b6d9aa2b44f4e788dc3ef9dfc79d52375e0

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16/07/2024, 10:25

Target

4de7cb56b4dbeb8750a0ac6ac8cd280c_JaffaCakes118.dll
Size

56KB
MD5

4de7cb56b4dbeb8750a0ac6ac8cd280c
SHA1

d34450c29c33e78ee1927072d30f955fe207aa1e
SHA256

b4a1483f78bfc8a3d5c03e30fb3b3b6d9aa2b44f4e788dc3ef9dfc79d52375e0
SHA512

6297f21706eddd5a1e1de552183dc3cc1863ad087029493a3c3115b2e6b4a9b8f9d17a7e63a04759d44ffd8842540dbcd86eb2ccc4eae507c85c1b81833eb388
SSDEEP

1536:c+ItHAg0Y+WiABVQohIpNhqCdP84iODD7a8CTb:gJAm+WiABeohIpNnva8CTb

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 4844	4464	rundll32.exe	83
PID 4464 wrote to memory of 4844	4464	rundll32.exe	83
PID 4464 wrote to memory of 4844	4464	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4de7cb56b4dbeb8750a0ac6ac8cd280c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4de7cb56b4dbeb8750a0ac6ac8cd280c_JaffaCakes118.dll,#1
  2⤵
  PID:4844