77b1a9dbe7e035ca7ff001f8b385a5a81086aa2b51aa9c79947daf98490e7e12

Analysis

max time kernel
142s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 17:10

Target

5ce0eacb3aa6ee0158c4d092d7c735a2_JaffaCakes118.dll
Size

23KB
MD5

5ce0eacb3aa6ee0158c4d092d7c735a2
SHA1

0b88f1c4d808a67e2db14b5b379895a0d1a616d4
SHA256

77b1a9dbe7e035ca7ff001f8b385a5a81086aa2b51aa9c79947daf98490e7e12
SHA512

2e783b8230513d166de564cfd337482b219b87c47f248ec8f60173a1596a53e5044c5d6b1490de16ef74b198de99f093d09118b9f6c822e33c6f977ae4b72a3e
SSDEEP

96:zthspyjnVLrap6yjmBuFsrXs6r8SWqMts1FMpwrXs2LLXsSLsKrsSrs+s6ydw8S7:DWxjjF0QkWGZ0I9vrpb+

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3300 wrote to memory of 2160	3300	rundll32.exe	84
PID 3300 wrote to memory of 2160	3300	rundll32.exe	84
PID 3300 wrote to memory of 2160	3300	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ce0eacb3aa6ee0158c4d092d7c735a2_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ce0eacb3aa6ee0158c4d092d7c735a2_JaffaCakes118.dll,#1
  2⤵
  PID:2160