d6ec87231daa42884b107891dbba1ffd3bf96138dc452ce013df529f399c5767

Analysis

max time kernel
139s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 22:18

Target

65045e192c918480b969ebc90c8fb9bd_JaffaCakes118.dll
Size

50KB
MD5

65045e192c918480b969ebc90c8fb9bd
SHA1

be8b6c354f4da82b52d64298e3a9e9592826b11f
SHA256

d6ec87231daa42884b107891dbba1ffd3bf96138dc452ce013df529f399c5767
SHA512

6fe3abf85d9f5c894e5f7443dd2d27ab08ca08fef5e6f7d7300f90d1f67ef37f9ad4266b7a1482f9b489ab26f61317ec6c84d62d5315ddcc4ea4f6facd6d659b
SSDEEP

768:d8OXAU5UHkxZk95PasqBm8T+PgJj2mEGurTpXMN42OKrv0rVjCaK:2kQkI5is6V6PgJKTzTNMN42OKz0rsaK

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 4724	1868	rundll32.exe	84
PID 1868 wrote to memory of 4724	1868	rundll32.exe	84
PID 1868 wrote to memory of 4724	1868	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\65045e192c918480b969ebc90c8fb9bd_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\65045e192c918480b969ebc90c8fb9bd_JaffaCakes118.dll,#1
  2⤵
  PID:4724