e4bc6b57346173c8f8c3494d6480507c995e2681074b315a4554933d26264bb8

Analysis

max time kernel
95s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 22:02

Target

32246eaf4e03a15df59146530248d99c_JaffaCakes118.dll
Size

93KB
MD5

32246eaf4e03a15df59146530248d99c
SHA1

f0597c2c4439bcf72e7e257338dbdc61eea947a4
SHA256

e4bc6b57346173c8f8c3494d6480507c995e2681074b315a4554933d26264bb8
SHA512

2eeab41ded6bf8e4fec7f382c464dd0def5e9731fb70ce30664933f3bc1f6e25a0e98f4170ce0915c97578717718ad6300d3ad745774cc94538c6428747d33d2
SSDEEP

1536:4clyOLe6eMlYgNhaRp+PMzOEDfF8yV/B5i5RNz:4clyuTjYAhoppFFJV/B5i5RNz

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3672 wrote to memory of 1508	3672	rundll32.exe	81
PID 3672 wrote to memory of 1508	3672	rundll32.exe	81
PID 3672 wrote to memory of 1508	3672	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\32246eaf4e03a15df59146530248d99c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3672
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\32246eaf4e03a15df59146530248d99c_JaffaCakes118.dll,#1
  2⤵
  PID:1508