d2634418f0eba8eed71efb9b7c18e10e1b5aaa37e9db38145a2302cb1d150c9b

Analysis

max time kernel
93s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 20:06

Target

3a8b36dd0c7ca4a933971ffb12ab7628_JaffaCakes118.dll
Size

100KB
MD5

3a8b36dd0c7ca4a933971ffb12ab7628
SHA1

fa481122e79eb7b6809e1e3c2523b12a56ba5b11
SHA256

d2634418f0eba8eed71efb9b7c18e10e1b5aaa37e9db38145a2302cb1d150c9b
SHA512

d0dbb1ef000abc7dd7fc29e72aadcafbfe31e33ee5feb73aafa4f4a6f50840a09c8fe3ff7580f6cd355c1d54c116bf687e7b1559bfeacf0491237e28b1e17581
SSDEEP

3072:xauBEHahO+xRqOvNcW8Y1wvbQyQOtzGpzH:NYa1xVv+Y1wGOtzCz

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 916 wrote to memory of 3976	916	rundll32.exe	84
PID 916 wrote to memory of 3976	916	rundll32.exe	84
PID 916 wrote to memory of 3976	916	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a8b36dd0c7ca4a933971ffb12ab7628_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:916
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a8b36dd0c7ca4a933971ffb12ab7628_JaffaCakes118.dll,#1
  2⤵
  PID:3976