d2177f0737d224a8114df0ef8757c78c480077abb3423a8a1a0a4ccd33ccd5f9

Analysis

max time kernel
147s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19-07-2024 09:28

Target

5b5b8dd7662263d93bb6bd075ebb8cb0_JaffaCakes118.dll
Size

340KB
MD5

5b5b8dd7662263d93bb6bd075ebb8cb0
SHA1

8f6e121ea4090701e6a88d3ddeb8c20440013586
SHA256

d2177f0737d224a8114df0ef8757c78c480077abb3423a8a1a0a4ccd33ccd5f9
SHA512

1ed9e24a59425bb0875f2342f63dc23a908d927986dc85dd1a10f393726d49a170e20a690e480ea3c84397ccc7d0c1e69626101f96a18cb75f5a8b19331432d5
SSDEEP

3072:nvA1p08RqEQAIVEd2gG/vNlo0JFx/pANyCm0PQEKR/JnXHWP:n206xWgGxLxWN40PDKR/JnX2P

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4568 wrote to memory of 680	4568	rundll32.exe	84
PID 4568 wrote to memory of 680	4568	rundll32.exe	84
PID 4568 wrote to memory of 680	4568	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5b5b8dd7662263d93bb6bd075ebb8cb0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5b5b8dd7662263d93bb6bd075ebb8cb0_JaffaCakes118.dll,#1
  2⤵
  PID:680