bec5ea2899786abb9f9e335896c81bfa51cf6f659beae15a9a8c030a755ab4f0

Analysis

max time kernel
136s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2024, 08:31

Target

5fc344fe50f3b7654c72ada19b17c841_JaffaCakes118.dll
Size

97KB
MD5

5fc344fe50f3b7654c72ada19b17c841
SHA1

87042774e8ed723a394f3f3f65168380600e1dc6
SHA256

bec5ea2899786abb9f9e335896c81bfa51cf6f659beae15a9a8c030a755ab4f0
SHA512

8c138452bc54eaabf9fd1e662e403e6645ad19030ca9f6b726f89b0c249693e7ed4d53e19d0986b157ead421ad9a4732185b4040df55b21a7f89b2d13b85eb0c
SSDEEP

1536:JA6stcQ6tj4s5B+Fc+rvlUyJkRhpUvpCAh+osaGkL5nDhFo0Cr0:JA6si1t6c6NUymXxo/GkL5nDhWm

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4484 wrote to memory of 4044	4484	rundll32.exe	84
PID 4484 wrote to memory of 4044	4484	rundll32.exe	84
PID 4484 wrote to memory of 4044	4484	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5fc344fe50f3b7654c72ada19b17c841_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5fc344fe50f3b7654c72ada19b17c841_JaffaCakes118.dll,#1
  2⤵
  PID:4044