7827d1751dc44c69f614564b734a87d261906b757b81f39f8686a50eb6334af2

Analysis

max time kernel
136s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 18:31

Target

644e8684e4b69bbfecb0fffdde358c2f_JaffaCakes118.dll
Size

20KB
MD5

644e8684e4b69bbfecb0fffdde358c2f
SHA1

94c15e9e09eb82b201f63b442265f7341650b23d
SHA256

7827d1751dc44c69f614564b734a87d261906b757b81f39f8686a50eb6334af2
SHA512

906d50c1366bbc02709f91a075a175a31cde6c10ff5db259c80133329e8653cdce1e97ae78f27807063285ae97c13a0b25c4171067b2bcb39f8c6a0dffd39751
SSDEEP

384:dx++uZNUL1bQE1ysPmkDnEuV0uqXRIoa6:6+k6JbQE1ysPmkg6GRLa6

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3144 wrote to memory of 4852	3144	rundll32.exe	84
PID 3144 wrote to memory of 4852	3144	rundll32.exe	84
PID 3144 wrote to memory of 4852	3144	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\644e8684e4b69bbfecb0fffdde358c2f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\644e8684e4b69bbfecb0fffdde358c2f_JaffaCakes118.dll,#1
  2⤵
  PID:4852