c74c73620ecf20e3053aac454748a56424151a58810a3c89eec3393b0288d4e0

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 19:27

Target

647d3e5968e587fe57e1c8bb429e1893_JaffaCakes118.dll
Size

50KB
MD5

647d3e5968e587fe57e1c8bb429e1893
SHA1

18a510b781a1921ee1e3eae464af753560435dd1
SHA256

c74c73620ecf20e3053aac454748a56424151a58810a3c89eec3393b0288d4e0
SHA512

86f24d0def274fb46c591e75582fc7f88d785c5d6436360ca2b5334457aa85f59f468e4a0daedc04f950b29ca45874379253978ff4269ff478bf83e27bed9cdd
SSDEEP

1536:+zQ55nvjrP/cukXDcubtQzqm0I5lKIrP8xF:+M55n/kuCgYdm0VIrP8

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 1584	1648	rundll32.exe	84
PID 1648 wrote to memory of 1584	1648	rundll32.exe	84
PID 1648 wrote to memory of 1584	1648	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\647d3e5968e587fe57e1c8bb429e1893_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\647d3e5968e587fe57e1c8bb429e1893_JaffaCakes118.dll,#1
  2⤵
  PID:1584