dffe033eaa04e02ba1c1cd43dc305ab65ddf8c6fca15899c935c8d7d2390f305

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 20:54

Target

64c51d2a6b234fafd81ac73194775898_JaffaCakes118.dll
Size

73KB
MD5

64c51d2a6b234fafd81ac73194775898
SHA1

89394a6ebb475074c3d30ca497eb4343b5c328d3
SHA256

dffe033eaa04e02ba1c1cd43dc305ab65ddf8c6fca15899c935c8d7d2390f305
SHA512

790745182431006426b103ed1cfe02a063c716ab8fe8694c2ad1cde902e73e32c6d9a03b63f8da2f2f7fba334bb8e009cae136fcb8be2c0fa445250d89c35624
SSDEEP

768:h+Niuj+0sY9zFeF98GVBDS1gAfCG+vn45:hO+0smz8F9rS1rf+PA

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 3876	1036	rundll32.exe	84
PID 1036 wrote to memory of 3876	1036	rundll32.exe	84
PID 1036 wrote to memory of 3876	1036	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\64c51d2a6b234fafd81ac73194775898_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\64c51d2a6b234fafd81ac73194775898_JaffaCakes118.dll,#1
  2⤵
  PID:3876