daa1c17f1c17f390bc2e3a544641e37057a7856b1112a454f861b5a5baf268f8

Analysis

max time kernel
139s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 22:15

Target

5de5bdb8b93c13ee820389b529011441_JaffaCakes118.dll
Size

36KB
MD5

5de5bdb8b93c13ee820389b529011441
SHA1

e9cf6bc1e153734059d0f78160a1bbe7c1188c80
SHA256

daa1c17f1c17f390bc2e3a544641e37057a7856b1112a454f861b5a5baf268f8
SHA512

57d7907b3d188a8b45bbdd0c264e20a91c1654c0fd1f6a593b93958355b67cde0ca522f1297aef37b17f90a976d47d9f826bebefa736fb5522f20613e481e032
SSDEEP

384:SaSO9tXngEF/Odg2aHXmcK5Alpopwm0dhS3+yW/Wz:SCbXngAx2amcDpopwmChK

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4496 wrote to memory of 1900	4496	rundll32.exe	84
PID 4496 wrote to memory of 1900	4496	rundll32.exe	84
PID 4496 wrote to memory of 1900	4496	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5de5bdb8b93c13ee820389b529011441_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5de5bdb8b93c13ee820389b529011441_JaffaCakes118.dll,#1
  2⤵
  PID:1900