dc27779f4bfbb18de985c02cd0c1004f23a8f74e816aca4b5c5af39e0dae6ed9

Analysis

max time kernel
93s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 03:45

Target

5a577dc9469ae768b672d8f7551b582f_JaffaCakes118.dll
Size

105KB
MD5

5a577dc9469ae768b672d8f7551b582f
SHA1

e3cebc3bf01f6c6992102e9715d0084f84381e45
SHA256

dc27779f4bfbb18de985c02cd0c1004f23a8f74e816aca4b5c5af39e0dae6ed9
SHA512

54a1baea9de260d6f4abe0b13e8867b88b169b1bc8f076117aac5aa53537980ab77032beedc80ad1e7689420d5ed3ace713b123b501a4a55859f6ad1887599a4
SSDEEP

768:UusN7RiFAhsHp1ekdm0hk0x0y7vFqE+qSGyLmf4j9eFooCSqztuFMiZ:UBDimhsHp1eyt0p6yazuvSEtE

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 2096	1892	rundll32.exe	83
PID 1892 wrote to memory of 2096	1892	rundll32.exe	83
PID 1892 wrote to memory of 2096	1892	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a577dc9469ae768b672d8f7551b582f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a577dc9469ae768b672d8f7551b582f_JaffaCakes118.dll,#1
  2⤵
  PID:2096