4417244503a280346ef697879e56f2cb73b24bab99a11b9ea20c8c9ce8f11826

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11-07-2024 17:48

Target

3a257827f9ef8197b961ec38dc25cc2b_JaffaCakes118.dll
Size

68KB
MD5

3a257827f9ef8197b961ec38dc25cc2b
SHA1

a1bfc6f1be65b461aa87b7b5e0a3a5c862cc2090
SHA256

4417244503a280346ef697879e56f2cb73b24bab99a11b9ea20c8c9ce8f11826
SHA512

1a5629a847e133115bcd310d4967cb6f6a3fbd20d3c8ae5d7b785b6ba80e16a562a5a877d82522a321f54bceeb6b3b0603d23f485d8ca40350c6f1ec5b90bdde
SSDEEP

1536:vc9jcxbSXgNtyxGC3oC3wWdMQbByBQpTl4Pw4PX:lxbSqsGkNgWdMWyBQpT6Pw4

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 4652	2400	rundll32.exe	83
PID 2400 wrote to memory of 4652	2400	rundll32.exe	83
PID 2400 wrote to memory of 4652	2400	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a257827f9ef8197b961ec38dc25cc2b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a257827f9ef8197b961ec38dc25cc2b_JaffaCakes118.dll,#1
  2⤵
  PID:4652