63a391583acc840709402da9b03370a2d4501e8582a31123105f3097633172f7

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 14:37

Target

67f835300d6a7a4098ff25d436bc9264_JaffaCakes118.dll
Size

24KB
MD5

67f835300d6a7a4098ff25d436bc9264
SHA1

16470e0ba3b321a9236f6373423a202c29224398
SHA256

63a391583acc840709402da9b03370a2d4501e8582a31123105f3097633172f7
SHA512

290ad7c1f743c2fe38d3a8e9698e728f8ad203063b1deb8420b16c7949470653e5f288fe8fe61f51562ba5699f4869b20dc8d5ea5544ca719465002f47fc1765
SSDEEP

192:asNGS9RWanc9Lht82SrBOUzk9m4VM8GjFVemPej8V1TqMXkOu:acG8W59LhtEQA/4O82FV9PS8Vkwkl

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 4464	2156	rundll32.exe	84
PID 2156 wrote to memory of 4464	2156	rundll32.exe	84
PID 2156 wrote to memory of 4464	2156	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\67f835300d6a7a4098ff25d436bc9264_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\67f835300d6a7a4098ff25d436bc9264_JaffaCakes118.dll,#1
  2⤵
  PID:4464