559bf63ccac42a670405351df2d62a2576946a3fc04f6c2e8778bb45bc61cb8c

Analysis

max time kernel
138s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2024, 17:22

Target

60bc90760c8c170f5e9bb6069a3598fa_JaffaCakes118.dll
Size

42KB
MD5

60bc90760c8c170f5e9bb6069a3598fa
SHA1

010a304e17eceff4cf4a27ec0da56cf5219ebf3a
SHA256

559bf63ccac42a670405351df2d62a2576946a3fc04f6c2e8778bb45bc61cb8c
SHA512

020eaacd95d09972fa976734537f432ec1d64ecff6d24cd2459d15f315058f8828e4c3cf0df9cf76d2c90fba19afa37057678f5261ac42bcf72f7332fd7cc9ac
SSDEEP

768:OlAqQidiEgzdbkpjhWToENNqDKt76mr7TKttBro7PpPJdTWBnRECriM:6A/6bgzB0FENNqCFr7TKJroBLanREC/

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3936 wrote to memory of 3364	3936	rundll32.exe	84
PID 3936 wrote to memory of 3364	3936	rundll32.exe	84
PID 3936 wrote to memory of 3364	3936	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\60bc90760c8c170f5e9bb6069a3598fa_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\60bc90760c8c170f5e9bb6069a3598fa_JaffaCakes118.dll,#1
  2⤵
  PID:3364