a5a967bfc0e4ab5ef9e16ce7c434b3ea139fd3403d5bd18f291b17cdf742b998

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2024, 12:06

Target

b36c15f469512caad612960b3884922c_JaffaCakes118.dll
Size

160KB
MD5

b36c15f469512caad612960b3884922c
SHA1

36161668d9be3205350019ac5a1655da1bba2b15
SHA256

a5a967bfc0e4ab5ef9e16ce7c434b3ea139fd3403d5bd18f291b17cdf742b998
SHA512

913aa9d1ed6b182082b8517d5afe7196b7c56d20058f0e02993487ad0e5a1cd0e4bc846ce1e36c9de78257ded31e8f58e7290bddbe2d31b1db8655ab59d82727
SSDEEP

3072:7YA/C7HYO/eo4bKjX2dCqUoS+GRZOB59TO4:WcO/GEz/RZOBjV

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 1524	1180	rundll32.exe	82
PID 1180 wrote to memory of 1524	1180	rundll32.exe	82
PID 1180 wrote to memory of 1524	1180	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b36c15f469512caad612960b3884922c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b36c15f469512caad612960b3884922c_JaffaCakes118.dll,#1
  2⤵
  PID:1524