23f59fe9dd05994a519f673d97db3ce4b8040248f769c9f757351675fcb89574

Analysis

max time kernel
143s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21-07-2024 21:26

Target

617578bcc38297f66eff1aa7393fbea0_JaffaCakes118.dll
Size

276KB
MD5

617578bcc38297f66eff1aa7393fbea0
SHA1

50e8c64a8753ace71ef9a0c83176d1fdb4bd1d77
SHA256

23f59fe9dd05994a519f673d97db3ce4b8040248f769c9f757351675fcb89574
SHA512

f3d073cd91a5d6d3595cd26471e39aef0f51296c123dd37e0152626a0ccac9c7bd4cfa9b235eacbcae7eb437bc5ff0a6f1370cdb39c66e2634151dc3857a45e2
SSDEEP

6144:TKwBDH/AVywAMsCJWnkVEzxsgcMdrG/hK8YuqvpabDs8Z5uhd5ahmvTEPN7kA:+wZfAowtvKwEzxsgcMdrG/hK8YuqI48e

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4408 wrote to memory of 3536	4408	rundll32.exe	84
PID 4408 wrote to memory of 3536	4408	rundll32.exe	84
PID 4408 wrote to memory of 3536	4408	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\617578bcc38297f66eff1aa7393fbea0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4408
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\617578bcc38297f66eff1aa7393fbea0_JaffaCakes118.dll,#1
  2⤵
  PID:3536