bf3abb2449f44488296cb2ad124eb8a27e6699820c9dc416ed7607e6fd3dc019

Analysis

max time kernel
141s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23-07-2024 09:38

Target

670cf882d918eb6b3069dd77d57d2dd4_JaffaCakes118.dll
Size

40KB
MD5

670cf882d918eb6b3069dd77d57d2dd4
SHA1

b649f2d0aabbbca9ed8cfd116fc2bef74fe86ec3
SHA256

bf3abb2449f44488296cb2ad124eb8a27e6699820c9dc416ed7607e6fd3dc019
SHA512

b807aab81b3d259dbb4295738086f37ec42eeb2ed18e06891be8e4023aa41cdfe8c0e37a76a1d925b5357141f11844911b44e90a67a67f12b07c4ad64d9944fe
SSDEEP

768:351OXtBKUKWwHAmQKdV/4hwu0W0ZfBm9u/QMgT:35cd77wHAmQKj/4hv0X/CT

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3428 wrote to memory of 2336	3428	rundll32.exe	84
PID 3428 wrote to memory of 2336	3428	rundll32.exe	84
PID 3428 wrote to memory of 2336	3428	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\670cf882d918eb6b3069dd77d57d2dd4_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3428
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\670cf882d918eb6b3069dd77d57d2dd4_JaffaCakes118.dll,#1
  2⤵
  PID:2336