299f8a047dbbdd8e098e3b48f46b0da92179ef8cdaac30f70e4e7c3a158a690f

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 16:29

Target

35813d303e4ee2e22f06348644748a57_JaffaCakes118.dll
Size

94KB
MD5

35813d303e4ee2e22f06348644748a57
SHA1

286dd561e2dc9a74ef6ac21a510b99fc0fc4dac3
SHA256

299f8a047dbbdd8e098e3b48f46b0da92179ef8cdaac30f70e4e7c3a158a690f
SHA512

f2af0fbbf8fdc6dda4a2008f4904388ef248901dc0fa7f19a74323c93dad411236a83bef5051a740268c1717492f1e3ba341dfdd29193e335b12eb9f1e9f376f
SSDEEP

1536:4GEs21Rxa+CSXIwyTPK3ArsgUMjDYoEXZe34ObplYrQSWYeol5wc2bfm5MEkR:4M21K+JXIwyjoArdApShY15wX

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4072 wrote to memory of 3596	4072	rundll32.exe	84
PID 4072 wrote to memory of 3596	4072	rundll32.exe	84
PID 4072 wrote to memory of 3596	4072	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\35813d303e4ee2e22f06348644748a57_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\35813d303e4ee2e22f06348644748a57_JaffaCakes118.dll,#1
  2⤵
  PID:3596