c3f191a82d555f1d17169ba8ace653f20575130841de0f1c95c05ea6ae5f97a1

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25-06-2024 08:54

Target

0d731dc56216a5d6084dc60677aea655_JaffaCakes118.dll
Size

122KB
MD5

0d731dc56216a5d6084dc60677aea655
SHA1

05d24e5a5a3ed933c059e0b8b1a3b92c3ad6099d
SHA256

c3f191a82d555f1d17169ba8ace653f20575130841de0f1c95c05ea6ae5f97a1
SHA512

05f67e77fb432e5042b283e9a41228e08d1792a5764b1b88f8709d479400ac4c1e5665b1195c61f36115557452bfb7f22b6d1cbaeeb354b27041733075d95c95
SSDEEP

384:u1ejSzwtTlqm3rZHAO3KCrHZnFWKEUlA8fxF47DL+q2iRXOi9ybBzDbJQ:u1ejlN3rjHZFWvczm7DrRXO9bVpQ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 3312	4896	rundll32.exe	81
PID 4896 wrote to memory of 3312	4896	rundll32.exe	81
PID 4896 wrote to memory of 3312	4896	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d731dc56216a5d6084dc60677aea655_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d731dc56216a5d6084dc60677aea655_JaffaCakes118.dll,#1
  2⤵
  PID:3312