3eaa7ecae64e43d2e57a980504cd48500f480b4bb281a39392cd697a7b9a1145

Analysis

max time kernel
93s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
17/07/2024, 21:46

Target

54ebd1a7aff2cd4e19e827146dcfac35_JaffaCakes118.dll
Size

340KB
MD5

54ebd1a7aff2cd4e19e827146dcfac35
SHA1

67842514869cf73a2a8c99c511f89ef31b1d1a0d
SHA256

3eaa7ecae64e43d2e57a980504cd48500f480b4bb281a39392cd697a7b9a1145
SHA512

bd280004df817311e713114d170b37062ae13f9ccd8dd92149cec1ebec28d88c83575fbcde2e7fe4dc382d8d13c34ef9132bd03e9f5c9c25b7192f3c3ba8f210
SSDEEP

3072:dvA1p08RqEQAIVEd2gG/vNlo0JFx/pANyCm0PQEKR/JnXRca:d206xWgGxLxWN40PDKR/JnXya

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4672 wrote to memory of 2640	4672	rundll32.exe	84
PID 4672 wrote to memory of 2640	4672	rundll32.exe	84
PID 4672 wrote to memory of 2640	4672	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\54ebd1a7aff2cd4e19e827146dcfac35_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\54ebd1a7aff2cd4e19e827146dcfac35_JaffaCakes118.dll,#1
  2⤵
  PID:2640