8cfa8724ce319ba4bea561038443fb5eb9630ef8b02e69f82c742a7380ab5c4b

Analysis

max time kernel
140s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 07:10

Target

669c038ce01b624c9500daca4e55899a_JaffaCakes118.dll
Size

204KB
MD5

669c038ce01b624c9500daca4e55899a
SHA1

2e197672be6e989347a5bd813b87d34bf9d53a4a
SHA256

8cfa8724ce319ba4bea561038443fb5eb9630ef8b02e69f82c742a7380ab5c4b
SHA512

2f1f4d47c45ffdf4ce98505b820cc350a5b2d36acad6100a7a2d39500c76ac879e6ab5767f1284ff18c7a88ff06f4d8b8188a8d3be26a63f127ea25f448660f0
SSDEEP

3072:Y9mqZ5xn7NWydCdyDIjxrCxDTqJ85bG7LNYaVZ4vSccGRbTm/0qHkcO5VnGA1uCh:mBR48TIvNYMyuCj2w

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 1492	4600	rundll32.exe	84
PID 4600 wrote to memory of 1492	4600	rundll32.exe	84
PID 4600 wrote to memory of 1492	4600	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\669c038ce01b624c9500daca4e55899a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\669c038ce01b624c9500daca4e55899a_JaffaCakes118.dll,#1
  2⤵
  PID:1492