40850016bcdcfc8dc47c5ff22d6a1f8fb8c7ecfbbec8972261c421e1b2b336e6

Analysis

max time kernel
93s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23-07-2024 11:06

Target

6754a521e208f5c8646c89b97a150595_JaffaCakes118.dll
Size

340KB
MD5

6754a521e208f5c8646c89b97a150595
SHA1

59baadd204c91598883f88c792e424e475ca0b4d
SHA256

40850016bcdcfc8dc47c5ff22d6a1f8fb8c7ecfbbec8972261c421e1b2b336e6
SHA512

07f63843675b7a0967f9930fe5a7b51382a753abf177a4169b601162d844705ea0c4e32ed0d0434dd54b7b3d842b0ecf96f4022348c4943aff8f8185b4503648
SSDEEP

3072:CUvA1p08RqEQAIVEd2gG/vNlo0JFx/pANyCm0PQEKR/JnXHWP:CU206xWgGxLxWN40PDKR/JnX2P

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 1612	2852	rundll32.exe	84
PID 2852 wrote to memory of 1612	2852	rundll32.exe	84
PID 2852 wrote to memory of 1612	2852	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6754a521e208f5c8646c89b97a150595_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6754a521e208f5c8646c89b97a150595_JaffaCakes118.dll,#1
  2⤵
  PID:1612