3f0fa6a41d35c06c6dcfa62a63cd370f653bf4869379582931ac417c746fe70e

Analysis

max time kernel
67s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
26-04-2024 14:06

Target

00efb0d00e8ecea883e12c78a339046f_JaffaCakes118.dll
Size

157KB
MD5

00efb0d00e8ecea883e12c78a339046f
SHA1

de5c5c278bb2cec4db6f66d83334a74f66267d97
SHA256

3f0fa6a41d35c06c6dcfa62a63cd370f653bf4869379582931ac417c746fe70e
SHA512

fdedfe7dcfa264b7f5cbcb1fdc50b8d565e47fbc11d28ff0be8570beabc48ad49734aead8ff1751b378c1ba83cb21e9cb178b0cdd4bacc93143a45f7ecd5ce25
SSDEEP

3072:1nvtIWvacDu3oEZvjZDcj+iEoG5b8Ag0bA3V2Ss06NFQ:1vtIk1uYEFFDca8AbSaF

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1416 wrote to memory of 3732	1416	rundll32.exe	rundll32.exe
PID 1416 wrote to memory of 3732	1416	rundll32.exe	rundll32.exe
PID 1416 wrote to memory of 3732	1416	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\00efb0d00e8ecea883e12c78a339046f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\00efb0d00e8ecea883e12c78a339046f_JaffaCakes118.dll,#1
  2⤵
  PID:3732