572d5ffe5c572e01524a01b61b98b49446c6b8cb20c279073b3452c7953564d3

Analysis

max time kernel
139s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 19:38

Target

64866c09cfd94ea12c212c50bf174059_JaffaCakes118.dll
Size

32KB
MD5

64866c09cfd94ea12c212c50bf174059
SHA1

a2ce8b639e20a4acd8a00c1963160e0a37cf06b9
SHA256

572d5ffe5c572e01524a01b61b98b49446c6b8cb20c279073b3452c7953564d3
SHA512

a4d69e533c84276387c9d87aa40965fc5af8c3e44e3af1c9166bf6965486aba514230e0ef04be76a3093cb83a104d2f3bef643671d0831dc09173d428c37f4ff
SSDEEP

768:bIh6p/HSZlfvKppbJ17vyfrxOVOGKLRqMjGf:E6pNppj7afryERqMjGf

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1108 wrote to memory of 1752	1108	rundll32.exe	84
PID 1108 wrote to memory of 1752	1108	rundll32.exe	84
PID 1108 wrote to memory of 1752	1108	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\64866c09cfd94ea12c212c50bf174059_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\64866c09cfd94ea12c212c50bf174059_JaffaCakes118.dll,#1
  2⤵
  PID:1752