ef034e513828899add75c3683aee21392d6d49b9c094146926bf540805b2beaf

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
17/07/2024, 14:49

Target

5377b3d7d3028a076ce5b7288b646d40_JaffaCakes118.dll
Size

340KB
MD5

5377b3d7d3028a076ce5b7288b646d40
SHA1

efc707447c2e6feed814909306e3a81c8a5b9a95
SHA256

ef034e513828899add75c3683aee21392d6d49b9c094146926bf540805b2beaf
SHA512

cd86625512ff586cb74b5f32fbd2d641c8e0b71ea4e7bb2ef4598747e7a5895189c688a8c0078becbcaabf046ef301935b9f085b8728129fbb633af2a1148515
SSDEEP

3072:AvA1p08RqEQAIVEd2gG/vNlo0JFx/pANyCm0PQEKR/JnXHWP:A206xWgGxLxWN40PDKR/JnX2P

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4444 wrote to memory of 4964	4444	rundll32.exe	86
PID 4444 wrote to memory of 4964	4444	rundll32.exe	86
PID 4444 wrote to memory of 4964	4444	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5377b3d7d3028a076ce5b7288b646d40_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4444
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5377b3d7d3028a076ce5b7288b646d40_JaffaCakes118.dll,#1
  2⤵
  PID:4964