40c963422ba1beafd3672d1cd035f649ff40202610bcf174c6b937ef04045d5c

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 12:30

Target

5bf45791a3187a723a05cbc1d8a438cd_JaffaCakes118.dll
Size

56KB
MD5

5bf45791a3187a723a05cbc1d8a438cd
SHA1

7f7e8c73f6df418cf23b24a7f99c961465b098a5
SHA256

40c963422ba1beafd3672d1cd035f649ff40202610bcf174c6b937ef04045d5c
SHA512

869ae7e93b43e8d1fc22507f0eb63dced81f529178bf4bb5fa0a0cba686477d91d171a721dc871f0739fc9803309e71cd75d11d3d6cc2e5e55147839d03e2262
SSDEEP

1536:wpbDtvLwe5HYKXikyo1KL9NELkJNaW00Ex:8bDtvLt5HYKXMBRuoJNNBEx

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 1936	4976	rundll32.exe	84
PID 4976 wrote to memory of 1936	4976	rundll32.exe	84
PID 4976 wrote to memory of 1936	4976	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5bf45791a3187a723a05cbc1d8a438cd_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5bf45791a3187a723a05cbc1d8a438cd_JaffaCakes118.dll,#1
  2⤵
  PID:1936