2170709ed4956e7edf5c070ee11927b1adb2dc34703208230c2eb0e7b4480c38

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2024, 20:55

Target

615d6c503d7669d31bdb51baff264f0f_JaffaCakes118.dll
Size

92KB
MD5

615d6c503d7669d31bdb51baff264f0f
SHA1

9c8a4c3725b0b83653d251c04ea0102d1de4adf4
SHA256

2170709ed4956e7edf5c070ee11927b1adb2dc34703208230c2eb0e7b4480c38
SHA512

34d0f87e834fb57debb5262f6ef475cceb1c923d85d058c281d96ad5dfd04a98774701912318f45957469b700fdc0ae0f90ef1ecc01c1628170e8eb8a1d1d864
SSDEEP

1536:iI12A93EScIR5Av46uTXdoUpIV0YxowlyZyOL:l12AtEScIp65XVHxoL8

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4792 wrote to memory of 4760	4792	rundll32.exe	84
PID 4792 wrote to memory of 4760	4792	rundll32.exe	84
PID 4792 wrote to memory of 4760	4792	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\615d6c503d7669d31bdb51baff264f0f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\615d6c503d7669d31bdb51baff264f0f_JaffaCakes118.dll,#1
  2⤵
  PID:4760