305e63bc814c37cc06d5f543e544f7fb08b79df68b13b4c670258fecc109d317

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 06:30

Target

5ad2f70d862688c1834cfe60a6957bc3_JaffaCakes118.dll
Size

24KB
MD5

5ad2f70d862688c1834cfe60a6957bc3
SHA1

14f93c8c1e846c138b5b70245b80d2e6fc94c655
SHA256

305e63bc814c37cc06d5f543e544f7fb08b79df68b13b4c670258fecc109d317
SHA512

9914839d6f3de56f58f02b7d369972bb061ddaf31dade21980efd03cdb90f6aa3a67972540b389f902e9cd4bbf473f8aceebd1dc009e316d61d3eb067d2cf519
SSDEEP

192:UmsNGS9RWanc9Lht82SrBOUzk9m4VM8GjFVemPej8V1TqMXkn:UmcG8W59LhtEQA/4O82FV9PS8Vkwkn

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 440 wrote to memory of 396	440	rundll32.exe	84
PID 440 wrote to memory of 396	440	rundll32.exe	84
PID 440 wrote to memory of 396	440	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ad2f70d862688c1834cfe60a6957bc3_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:440
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ad2f70d862688c1834cfe60a6957bc3_JaffaCakes118.dll,#1
  2⤵
  PID:396