4384e5a0d19aa15f4a43b318c54ec9b791132868c2ffa1c3e7004bafd4b51331

Analysis

max time kernel
93s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 00:33

Target

3707f90bae867a1864672d0b378ecccd_JaffaCakes118.dll
Size

273KB
MD5

3707f90bae867a1864672d0b378ecccd
SHA1

154f7084e2f677e59e3c0e06949d692776360149
SHA256

4384e5a0d19aa15f4a43b318c54ec9b791132868c2ffa1c3e7004bafd4b51331
SHA512

c65e7a5ba081c70f3d1a4e45398cd5e48ee5191b5483ecdb79388ef8cd64781a340ad7f51c19dd968e1746e5ff8954c1e9d51c2006b8043be51effdf3d3410f8
SSDEEP

6144:/crtRFiP2zQHM6RiRVA6AwcGt7ZTBlSv/6OgY65qzBk6W:/c020jEVA6/c67ZTXSv/Ymk6W

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4052 wrote to memory of 2400	4052	rundll32.exe	83
PID 4052 wrote to memory of 2400	4052	rundll32.exe	83
PID 4052 wrote to memory of 2400	4052	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3707f90bae867a1864672d0b378ecccd_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3707f90bae867a1864672d0b378ecccd_JaffaCakes118.dll,#1
  2⤵
  PID:2400