f202c26a83e93cd75c462a49847db11cc39a289fc5d7bbd481a40c92cc1351f1

Analysis

max time kernel
138s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 06:08

Target

666c58dd41912cdd9e59551791319852_JaffaCakes118.dll
Size

16KB
MD5

666c58dd41912cdd9e59551791319852
SHA1

4225f5d0ab7fb736338578afa5a0f3b469f9a68c
SHA256

f202c26a83e93cd75c462a49847db11cc39a289fc5d7bbd481a40c92cc1351f1
SHA512

83ed522ecf8fc1e834de839b5f5a7c9b3913e022c03abaa8b30f5052ceaf226054f659bf763faf3e6dae0ea00eeb2b838ee9d8e780740b385c728b7a17e9ae3b
SSDEEP

192:DG93JrcCNXQSi084aYgwgvSLtyxOq26mLBcbjyafAVkn5KqDDd2fIAmPzbWjM2F:DGvPX7V9ax/KZyxODAyaIw5zDuUKPF

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 1256	1016	rundll32.exe	84
PID 1016 wrote to memory of 1256	1016	rundll32.exe	84
PID 1016 wrote to memory of 1256	1016	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\666c58dd41912cdd9e59551791319852_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\666c58dd41912cdd9e59551791319852_JaffaCakes118.dll,#1
  2⤵
  PID:1256