15a37445204b74caf3e3385cf7839c8762f396ea0e401c463a756e544f6b30cc

Analysis

max time kernel
136s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 12:22

Target

4b0c01fed8cb1b32502f5da70b66dee3_JaffaCakes118.dll
Size

512KB
MD5

4b0c01fed8cb1b32502f5da70b66dee3
SHA1

547759df7edbb6da465788c67256086d82d3e61f
SHA256

15a37445204b74caf3e3385cf7839c8762f396ea0e401c463a756e544f6b30cc
SHA512

efd65b627108ef0cb32d2d286a052a33fa3d36173dee11fcaaaa7ea4c65e836749783122eafc5a6d7d41df1c2fd2a104d7814ecfb4a51c82e0cd092cada872ca
SSDEEP

12288:VyTMaUlu2BpLiPwlUfIKKuioD4LP22dwfItfYBX:VyTMaUllsQUfIKKuZAP23F

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3568 wrote to memory of 1772	3568	rundll32.exe	85
PID 3568 wrote to memory of 1772	3568	rundll32.exe	85
PID 3568 wrote to memory of 1772	3568	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b0c01fed8cb1b32502f5da70b66dee3_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3568
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b0c01fed8cb1b32502f5da70b66dee3_JaffaCakes118.dll,#1
  2⤵
  PID:1772