91b76a42b7b0f7cbd207ecda2f5c45d081a1ec5c96387a1def9682de669cf51c

Analysis

max time kernel
140s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 16:58

Target

6402fbb3182eece3ddca9a9eeac52541_JaffaCakes118.dll
Size

33KB
MD5

6402fbb3182eece3ddca9a9eeac52541
SHA1

9d30db374a31f4538881dd962ef7cb559a2c23b9
SHA256

91b76a42b7b0f7cbd207ecda2f5c45d081a1ec5c96387a1def9682de669cf51c
SHA512

f73e9e1d52c15f41211729913e3f9ffbe66d49f655bcde81f15f3e547f1c945cdc451082fd97adc97dadfb993b069ce38aab568ca0b87f0c2e931681f97bd4ae
SSDEEP

768:M9qeula2iuu4enYOE7IOIoSYhqD6RBu6J:M9qeulu4eYj7IOI2kGRB7J

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3276 wrote to memory of 2448	3276	rundll32.exe	86
PID 3276 wrote to memory of 2448	3276	rundll32.exe	86
PID 3276 wrote to memory of 2448	3276	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6402fbb3182eece3ddca9a9eeac52541_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3276
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6402fbb3182eece3ddca9a9eeac52541_JaffaCakes118.dll,#1
  2⤵
  PID:2448