1afde645d0134a54388a2373f2be68bfd889961c92d6d1df84b601b05bb2977c

Analysis

max time kernel
140s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2024, 21:32

Target

6179da9e675964114444b099d859528b_JaffaCakes118.dll
Size

33KB
MD5

6179da9e675964114444b099d859528b
SHA1

c25caadddc5f3b44f7c378c05d0dd182704fccd0
SHA256

1afde645d0134a54388a2373f2be68bfd889961c92d6d1df84b601b05bb2977c
SHA512

74838d31350fe028eac03741b6a74e4c9342ac0aa5deeca6e90029cf167405e5eb9c90cb0ace00ce3eb915c37c7b5e979cfaefedf6140f78c24119a410d4729a
SSDEEP

768:7+OuA6LwO0o5xPa1kHNNv7or7tB7cOZivRtv35:aOuA6LBxPxt17or7sTvRtvJ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 5064	4264	rundll32.exe	84
PID 4264 wrote to memory of 5064	4264	rundll32.exe	84
PID 4264 wrote to memory of 5064	4264	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6179da9e675964114444b099d859528b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6179da9e675964114444b099d859528b_JaffaCakes118.dll,#1
  2⤵
  PID:5064