0ae29463ad8ca96a4ad375104cb8b6a6752815cb9ca28707c8bf4bbd1a08e1fe

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 14:05

Target

35099fe87833143637f9d0feba39581e_JaffaCakes118.dll
Size

37KB
MD5

35099fe87833143637f9d0feba39581e
SHA1

ec18ec742742f01c2915c6dec8b17ea225185a09
SHA256

0ae29463ad8ca96a4ad375104cb8b6a6752815cb9ca28707c8bf4bbd1a08e1fe
SHA512

1c1e08ef160da798c98e8939cef87f9d90df71f6e9700c1f0a39041535931fe683b369c54a5470d2533708c7e08de7ccce4173c83ac633b60df54c9549cf2e2a
SSDEEP

384:Xo4QtOZmW277gV3e/MRi2AA5JyOj60hrFw0wR5SDhBf1Okn/KCMuka/Dw1rD63fL:Xlx/AOJyODFw0C5G/Kmmv4YXOG7PZf

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 1664	4572	rundll32.exe	83
PID 4572 wrote to memory of 1664	4572	rundll32.exe	83
PID 4572 wrote to memory of 1664	4572	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\35099fe87833143637f9d0feba39581e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\35099fe87833143637f9d0feba39581e_JaffaCakes118.dll,#1
  2⤵
  PID:1664