89ecae566033df706ecd852bec180d716caf2f138ae029c986c76294d77be02f

Analysis

max time kernel
137s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 05:20

Target

664a9aaa849e72d127ab4b4699587fa3_JaffaCakes118.dll
Size

24KB
MD5

664a9aaa849e72d127ab4b4699587fa3
SHA1

923bbcc6ae0dac9c30b2a62238681401523c4764
SHA256

89ecae566033df706ecd852bec180d716caf2f138ae029c986c76294d77be02f
SHA512

87390268b5875cbc3e35909375e73779d9cbde77733a478b06b483240f330ffface27985eb0adbc3b76af5205c2b7142ac300f15c7d9cbaf7229ed372c50e473
SSDEEP

192:pUn4e+2vvl53107GF4nkzww3z/oFQwVET6A6pct5UFdQ/0ky:pU9+WN5GGF4nkx3D4Qw9A6pct5yos

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4148 wrote to memory of 4484	4148	rundll32.exe	84
PID 4148 wrote to memory of 4484	4148	rundll32.exe	84
PID 4148 wrote to memory of 4484	4148	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\664a9aaa849e72d127ab4b4699587fa3_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\664a9aaa849e72d127ab4b4699587fa3_JaffaCakes118.dll,#1
  2⤵
  PID:4484