cb9058080e2feaa18ead3401a02d88b00d36fdf66387ccd1b75854d7bbd24311

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16-07-2024 12:18

Target

4e48924782ec7e53df704c8e90dc5aec_JaffaCakes118.dll
Size

340KB
MD5

4e48924782ec7e53df704c8e90dc5aec
SHA1

eb8b41e7a234a278ab72ff577f6ab6fb8fdc301f
SHA256

cb9058080e2feaa18ead3401a02d88b00d36fdf66387ccd1b75854d7bbd24311
SHA512

c063c6dedc4102941781f91e1b17cebc8d480f34539e9eb3ec71b36ef88035a7f5802a1f612854a62760d3d6704d09e911f98a6e44e0b1e2db484154be72505b
SSDEEP

3072:ZvA1p08RqEQAIVEd2gG/vNlo0JFx/pANyCm0PQEKR/JnXHWP:Z206xWgGxLxWN40PDKR/JnX2P

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 4032	4940	rundll32.exe	83
PID 4940 wrote to memory of 4032	4940	rundll32.exe	83
PID 4940 wrote to memory of 4032	4940	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4e48924782ec7e53df704c8e90dc5aec_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4e48924782ec7e53df704c8e90dc5aec_JaffaCakes118.dll,#1
  2⤵
  PID:4032