1634a41f11ff5d4516d815a34bb68141095991c1ecdc74c3f93ba6eb3d77a7b9

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 16:33

Target

099e90d8c36a9814595c93decca19218_JaffaCakes118.dll
Size

163KB
MD5

099e90d8c36a9814595c93decca19218
SHA1

ed0c83fb5de63b0676d6948b5c40a0324b3fe466
SHA256

1634a41f11ff5d4516d815a34bb68141095991c1ecdc74c3f93ba6eb3d77a7b9
SHA512

15ad979def06d4389b49956cd094bd037ff8f81e5a332cd2bda479d008ee3a18e90705008a8c906f9e03a0b8b4365e22f4c7cc4090f3714040b045f522807c3e
SSDEEP

3072:5/NrMHpfUkW+AvBMG6G38ZIVOd42ne/X9qJ2ai72:ZdMJ8kW+AvBMG6G38m4T+9qMai6

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 1012	2472	rundll32.exe	81
PID 2472 wrote to memory of 1012	2472	rundll32.exe	81
PID 2472 wrote to memory of 1012	2472	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\099e90d8c36a9814595c93decca19218_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\099e90d8c36a9814595c93decca19218_JaffaCakes118.dll,#1
  2⤵
  PID:1012