e3d21d4177abd62c9f56cdfc9261466aa7ec1ed34b238c889f06307ae159e527

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2024, 12:25

Target

f37e6b160e2dc597e1ac2c9da7629abc_JaffaCakes118.dll
Size

368KB
MD5

f37e6b160e2dc597e1ac2c9da7629abc
SHA1

ded209dd82a584922e3c0c2742a244ec89d88aaf
SHA256

e3d21d4177abd62c9f56cdfc9261466aa7ec1ed34b238c889f06307ae159e527
SHA512

783a2a8e7cbaea0c0d814faa36c7261c6c1151e7b8f60822cc8790348eb6d41f8e903bb0447207cd9a88f7b2f67a44a58e2779ff55070d6c3f09e160777666ee
SSDEEP

6144:2QeqBNvnbe6azhvNFtQPyL9Fm0+hfexwn:2QeaVbEtvvtQuFoee

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3540 wrote to memory of 3264	3540	rundll32.exe	85
PID 3540 wrote to memory of 3264	3540	rundll32.exe	85
PID 3540 wrote to memory of 3264	3540	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f37e6b160e2dc597e1ac2c9da7629abc_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3540
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f37e6b160e2dc597e1ac2c9da7629abc_JaffaCakes118.dll,#1
  2⤵
  PID:3264