d17f08b5d2f993297c87828725827b97cbb99c4b2b772193115573a5e87402c4

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 19:35

Target

5d5efeb5a982156a2f7e6307b33ed51e_JaffaCakes118.dll
Size

209KB
MD5

5d5efeb5a982156a2f7e6307b33ed51e
SHA1

4832ac976de73ac761970ffab7e773a282cfe40a
SHA256

d17f08b5d2f993297c87828725827b97cbb99c4b2b772193115573a5e87402c4
SHA512

ae75a16eb4a7882e6a34e9352ceee6003ec23642fdbced3f5235bd6ce19864a1351fa3bfa19b9740920aeb9d4e09423d97608ba15dce7423dfa344418509962a
SSDEEP

6144:PIa5arFJN2E0KBXTICWdX/19vmblsVNH8kNsau3:PibNH04yX/1Jm4Ns/3

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 380 wrote to memory of 4656	380	rundll32.exe	83
PID 380 wrote to memory of 4656	380	rundll32.exe	83
PID 380 wrote to memory of 4656	380	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5d5efeb5a982156a2f7e6307b33ed51e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5d5efeb5a982156a2f7e6307b33ed51e_JaffaCakes118.dll,#1
  2⤵
  PID:4656