1267e3309e832852c33acc00356bae54571184775e1ca0911c6b00fc717b431e

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 03:16

Target

3780c65d01f35a46194b983ecbf304eb_JaffaCakes118.dll
Size

32KB
MD5

3780c65d01f35a46194b983ecbf304eb
SHA1

1788a1c46ae749678f2b534b7a88f84e2cd58fb5
SHA256

1267e3309e832852c33acc00356bae54571184775e1ca0911c6b00fc717b431e
SHA512

3528a565d1e93f9644f23951c74fb4c7b40bada45d0cbcf8ef2d2e1ee47868d07429baa7384ef325297dc041530e20430340eff33f638dadcfbdf50ca66123ed
SSDEEP

768:GMhqpHLSlNb31pbNG7v6fbZOVOQKTRqMuBkK:7qpA1pQ7ifbK2RqMuBd

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4180 wrote to memory of 3464	4180	rundll32.exe	83
PID 4180 wrote to memory of 3464	4180	rundll32.exe	83
PID 4180 wrote to memory of 3464	4180	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3780c65d01f35a46194b983ecbf304eb_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3780c65d01f35a46194b983ecbf304eb_JaffaCakes118.dll,#1
  2⤵
  PID:3464