e14790c1f6f8dba748fbb96b6fdc5287862a34712e53428c3e45e206eef646e5

Analysis

max time kernel
142s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 12:44

Target

5bfea583c121ca718f6417917790dee8_JaffaCakes118.dll
Size

33KB
MD5

5bfea583c121ca718f6417917790dee8
SHA1

ae6a6de4e537cb9416d894f2342e3324f061a521
SHA256

e14790c1f6f8dba748fbb96b6fdc5287862a34712e53428c3e45e206eef646e5
SHA512

8f836ecfea09bf7a0cbc4b2fdfea18a7ca54f5dad6b4943aabb0a5e07ceeaba05bd267676f53fbb8c688a27e5ae72c9b283296918f3e376c93b262bb91e8c747
SSDEEP

768:y2M61pGt+eC8IIklhlM7gQ/WSIUt5hnDus6rRx3NtUw:y25LvSIIkrO7gdS1Xhys6Rx9tr

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3168 wrote to memory of 64	3168	rundll32.exe	84
PID 3168 wrote to memory of 64	3168	rundll32.exe	84
PID 3168 wrote to memory of 64	3168	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5bfea583c121ca718f6417917790dee8_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3168
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5bfea583c121ca718f6417917790dee8_JaffaCakes118.dll,#1
  2⤵
  PID:64