9611d0b1837e933b9d938e19791b757aa56669ec75b8fd671bdd1371eede03bb

Analysis

max time kernel
93s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13-05-2024 17:52

Target

3c1a8991e96f4c56ae3e90fb6f0ae679_JaffaCakes118.dll
Size

20KB
MD5

3c1a8991e96f4c56ae3e90fb6f0ae679
SHA1

41d72fa626cccadcd5aae3a0a652043e4a4f7b4a
SHA256

9611d0b1837e933b9d938e19791b757aa56669ec75b8fd671bdd1371eede03bb
SHA512

426f9efc955ec2c6c159f776c23f4784b989b6d216e860c7366c8620585e5c42c87c421906768355cd2b54773a46511050c3cce24af3f6fd0bf34e95a5dca19a
SSDEEP

192:ZcMdjzlmeno/hERhFXmIoozoZSiLpeaencO+MX1gcT:OMdjzIWRhFWIoozo4iFGnhg

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3900 wrote to memory of 3176	3900	rundll32.exe	82
PID 3900 wrote to memory of 3176	3900	rundll32.exe	82
PID 3900 wrote to memory of 3176	3900	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c1a8991e96f4c56ae3e90fb6f0ae679_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c1a8991e96f4c56ae3e90fb6f0ae679_JaffaCakes118.dll,#1
  2⤵
  PID:3176