fa55f6055da68cc6dec42cecd750a2102811cedb9a06cddbea7a170a6891ad9a

Analysis

max time kernel
94s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16-07-2024 15:02

Target

4ed8b1bd4a0038ea8b6c5742805483fb_JaffaCakes118.dll
Size

340KB
MD5

4ed8b1bd4a0038ea8b6c5742805483fb
SHA1

b06dafc879195a4fda0c0d38d2937625736cb3c8
SHA256

fa55f6055da68cc6dec42cecd750a2102811cedb9a06cddbea7a170a6891ad9a
SHA512

75f2c064e87f60d93a7c8328a42d71d16e3535efa21f6c7a4245e1bc15d928fb371f5f7bce9f6b5563ebdb25ffbdc2419dbf4fb06d648ac71015fd5c16e779f4
SSDEEP

3072:dvA1p08RqEQAIVEd2gG/vNlo0JFx/pANyCm0PQEKR/JnXHWP:d206xWgGxLxWN40PDKR/JnX2P

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 380	4996	rundll32.exe	83
PID 4996 wrote to memory of 380	4996	rundll32.exe	83
PID 4996 wrote to memory of 380	4996	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4ed8b1bd4a0038ea8b6c5742805483fb_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4ed8b1bd4a0038ea8b6c5742805483fb_JaffaCakes118.dll,#1
  2⤵
  PID:380