612a8b54a9c6ce93e7d95eccce6db52f58ccfaaf46d7a318f4414c538823abaa

Analysis

max time kernel
141s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23-07-2024 10:37

Target

673c6ada6edfd2e1d6786614fd7d07e6_JaffaCakes118.dll
Size

11KB
MD5

673c6ada6edfd2e1d6786614fd7d07e6
SHA1

90c25ba701f67194d3fdf59744c218344710445e
SHA256

612a8b54a9c6ce93e7d95eccce6db52f58ccfaaf46d7a318f4414c538823abaa
SHA512

27cd9544ba4d2ad76f626ee1ce6eea1b65a38ac48d63923106ad63b61fb3efb33b49b250319358e263b8a747ad2e0cba1cb2d73096155ad54676575fd6489905
SSDEEP

192:4JxoNSc57tNnE0eEdMKJCBHafMoAH8biCGDowHHPFBCiGhAzzN9qdHNK0:GR67tN1mKJuAMoU8biCQopi6DdHJ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 4168	2796	rundll32.exe	84
PID 2796 wrote to memory of 4168	2796	rundll32.exe	84
PID 2796 wrote to memory of 4168	2796	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\673c6ada6edfd2e1d6786614fd7d07e6_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\673c6ada6edfd2e1d6786614fd7d07e6_JaffaCakes118.dll,#1
  2⤵
  PID:4168