92893714884ff891badc4a83b53159664286b82301ee63ad96fcf5ae98fa83f7

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22-07-2024 22:07

Target

64faa1b2a9ffdd41e259b7d80545e9b3_JaffaCakes118.dll
Size

31KB
MD5

64faa1b2a9ffdd41e259b7d80545e9b3
SHA1

6738d43736d4034a68960b2c6d38b7d63709453f
SHA256

92893714884ff891badc4a83b53159664286b82301ee63ad96fcf5ae98fa83f7
SHA512

8ff8982de9729d58e45c5791c6b2f164579ab32af84f1a21b27de633b190850c5bc24de68624e68bb287eaac8793280262d1a8345753b821201c6ab5dfae75ba
SSDEEP

384:bZec7DMG5LksqD6Ur2kyQsAv7j1XiOxIb6teiDKHrlmK/TTdhpmTKE68veTeK9Td:bhD1L11/QHv9iOize6rRbTdjmrvAD

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3648 wrote to memory of 2700	3648	rundll32.exe	84
PID 3648 wrote to memory of 2700	3648	rundll32.exe	84
PID 3648 wrote to memory of 2700	3648	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\64faa1b2a9ffdd41e259b7d80545e9b3_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3648
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\64faa1b2a9ffdd41e259b7d80545e9b3_JaffaCakes118.dll,#1
  2⤵
  PID:2700