42ed01a887dd5472a3df96c1ea8ab36c532deaa58b679ec05569bdfde7a4116b

Analysis

max time kernel
94s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 03:26

Target

33200bdb47eb1f387bf01a933b745641_JaffaCakes118.dll
Size

260KB
MD5

33200bdb47eb1f387bf01a933b745641
SHA1

b6c494b14d1b93cd3a8ce7a024688683e974cd3a
SHA256

42ed01a887dd5472a3df96c1ea8ab36c532deaa58b679ec05569bdfde7a4116b
SHA512

55ee6593439e3cb0f137038643ea565877db22aca364dbd27a6eb41677f0c072ceab26b2df9e11d2e4a13d62fbafff04eda3b285424a3d91bc50dab947cf32b6
SSDEEP

3072:j3wEHcdKKNqtAF/R9K6ANye9WZwfCm/Au4NnZhgMmKgVOVxr9y9zPoe2tb9aIAgv:d8vNqtA3Qb9K7nheSmkr32

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 4264	4128	rundll32.exe	81
PID 4128 wrote to memory of 4264	4128	rundll32.exe	81
PID 4128 wrote to memory of 4264	4128	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\33200bdb47eb1f387bf01a933b745641_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\33200bdb47eb1f387bf01a933b745641_JaffaCakes118.dll,#1
  2⤵
  PID:4264