050572cdf971dd09bd63208ea2aa29e1063e4747be99e0b4b3be8ee7ac35ed8a

Analysis

max time kernel
95s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2024, 04:44

Target

5f11fb68747638a5c590f0107c68c299_JaffaCakes118.dll
Size

663KB
MD5

5f11fb68747638a5c590f0107c68c299
SHA1

519f4ce95529fbe6e5981237536a949d5290154f
SHA256

050572cdf971dd09bd63208ea2aa29e1063e4747be99e0b4b3be8ee7ac35ed8a
SHA512

252c68d3af1ff75fbfe16d906e4fdb3ba9936544c093326efa189ccb782174bff290b1ae8b768b713d7a4c2fb767a0135ab8b073ae31ad79471a3eaa4e925f02
SSDEEP

12288:lPFdRwUJyjncBx671PdcI5W9/NbuP0QbXLdzRgQTaYoJosBv:pzRhJyT5cI5WxJu7ZzRZTaJqsp

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3536 wrote to memory of 2896	3536	rundll32.exe	84
PID 3536 wrote to memory of 2896	3536	rundll32.exe	84
PID 3536 wrote to memory of 2896	3536	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5f11fb68747638a5c590f0107c68c299_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5f11fb68747638a5c590f0107c68c299_JaffaCakes118.dll,#1
  2⤵
  PID:2896