13191716f198773820070783fe9fa5dfb923b2c37b39af5b8f8baf86bd4e37c1

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 23:25

Target

8c269999768870233e51bd764e211578_JaffaCakes118.dll
Size

23KB
MD5

8c269999768870233e51bd764e211578
SHA1

89d3d91b63ccb3fda5be51c28a6df1cada804cd2
SHA256

13191716f198773820070783fe9fa5dfb923b2c37b39af5b8f8baf86bd4e37c1
SHA512

723b2076168c793e378b204e0e5ce2502af4782ec485a4c11fb750dbafff1c09029147531b6a8800bbba68e6aefecfa6d92d217ccdc02e5c411f606be04bc923
SSDEEP

384:LF40YeqVxDXdPV7ILPZKdtBly4RnLr3PL/Iv:FNqVhdPVGZKdtjy4R/Le

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 8 wrote to memory of 3480	8	rundll32.exe	82
PID 8 wrote to memory of 3480	8	rundll32.exe	82
PID 8 wrote to memory of 3480	8	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8c269999768870233e51bd764e211578_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:8
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8c269999768870233e51bd764e211578_JaffaCakes118.dll,#1
  2⤵
  PID:3480