118465e961b9003a0f7517f92eae4fc54c55e4b5ad8539792eda71c61b85996a

Analysis

max time kernel
136s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 09:46

Target

62bbf86fbbc1c24dd501c8ec429d1f30_JaffaCakes118.dll
Size

72KB
MD5

62bbf86fbbc1c24dd501c8ec429d1f30
SHA1

2197e979e12ca882508ffc62e6acb695b80f1489
SHA256

118465e961b9003a0f7517f92eae4fc54c55e4b5ad8539792eda71c61b85996a
SHA512

2929c10a4a868bbff847c37d0793db2c4bfa3ef10332f119b549e2a33bfa596cabd61a6f39c9f59cb628ec6f1a4832d7bd2da1eb6706abcf0636b1ce7b8aa65d
SSDEEP

1536:/LSeqjziajD3oxPl24OJ69CXDs6LF2JB:AWaf3Kd24264Ts6L4JB

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2588 wrote to memory of 3352	2588	rundll32.exe	84
PID 2588 wrote to memory of 3352	2588	rundll32.exe	84
PID 2588 wrote to memory of 3352	2588	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\62bbf86fbbc1c24dd501c8ec429d1f30_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\62bbf86fbbc1c24dd501c8ec429d1f30_JaffaCakes118.dll,#1
  2⤵
  PID:3352