564612a01bbe6f889b4ab996473ca83bac33c98797b1a8160f3494fabeb5af45

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 07:21

Target

33c5717474c36c77ed0b121346e93bab_JaffaCakes118.dll
Size

280KB
MD5

33c5717474c36c77ed0b121346e93bab
SHA1

ccfbde226841f8f2b5f60c543c55618d51d72591
SHA256

564612a01bbe6f889b4ab996473ca83bac33c98797b1a8160f3494fabeb5af45
SHA512

b3d0602e474181c467996ba309053d33c3334088fb12a8d0e18c4e14c78f28887df59d562546ca08255d9d568be10aaf4ade83ee4f994e0de28347900bac41e1
SSDEEP

3072:GLkzzzVwKrS7Kb+TgNYnS1wy7bHa6s7yV8y4lqwNXS+yYwDIRPhmjYicovvtL5o1:NzBSOk/nyDsFejVcwh5

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 884 wrote to memory of 4452	884	rundll32.exe	82
PID 884 wrote to memory of 4452	884	rundll32.exe	82
PID 884 wrote to memory of 4452	884	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\33c5717474c36c77ed0b121346e93bab_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:884
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\33c5717474c36c77ed0b121346e93bab_JaffaCakes118.dll,#1
  2⤵
  PID:4452