9ecc9445e6977730e43da36cd6c562f34edc3e6f1325fc55c6be8ab9fcb72710

Analysis

max time kernel
138s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 00:07

Target

655da865d40ab06954844c72016af919_JaffaCakes118.dll
Size

72KB
MD5

655da865d40ab06954844c72016af919
SHA1

4c321d4804240fd9830643fab08d107b304a79dc
SHA256

9ecc9445e6977730e43da36cd6c562f34edc3e6f1325fc55c6be8ab9fcb72710
SHA512

e31e8a9fc802be23e142e6c836f3980ab770a07e10b0122dd2b8dc50f9a15e473f72e4e8ecb2e5e2d6e8d42b7678e7e3417c313565e1b7c35c6f58a6319707be
SSDEEP

1536:3UPMadZgQ24x/tCcgQFPvXGNRfWlAPClJO:3T8KQ2K/txrt2NNClJ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 1184	2028	rundll32.exe	84
PID 2028 wrote to memory of 1184	2028	rundll32.exe	84
PID 2028 wrote to memory of 1184	2028	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\655da865d40ab06954844c72016af919_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\655da865d40ab06954844c72016af919_JaffaCakes118.dll,#1
  2⤵
  PID:1184