913292a0cb9e755df9d86330b946b7d3d6080f08d7148770cf340bbbfb19acb1

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 23:23

Target

f6cbf943649c45048922014616ba651e_JaffaCakes118.dll
Size

7KB
MD5

f6cbf943649c45048922014616ba651e
SHA1

36b910a861f6f60eb77851ca384eed0a1428af26
SHA256

913292a0cb9e755df9d86330b946b7d3d6080f08d7148770cf340bbbfb19acb1
SHA512

5a9ba62ea4f7011f4560d29ecfb50d48d6b80e8dcf099aaab09d86a09a0bb6574be0fa3b0980e3e0999bb08b9511668e545015eacea0c361120be49357d59b5d
SSDEEP

48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPWKbABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbP4q3qX5S2hV

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 3324	1032	rundll32.exe	84
PID 1032 wrote to memory of 3324	1032	rundll32.exe	84
PID 1032 wrote to memory of 3324	1032	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f6cbf943649c45048922014616ba651e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f6cbf943649c45048922014616ba651e_JaffaCakes118.dll,#1
  2⤵
  PID:3324