0a4c576caf754fb24ffac0da96e65d969a1c50dca3dd9e4c7563d5f0bdca7d33

Analysis

max time kernel
94s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 22:12

Target

3f139dbf8e8441cb2d314096dfc9ec3e_JaffaCakes118.dll
Size

72KB
MD5

3f139dbf8e8441cb2d314096dfc9ec3e
SHA1

c43a2e864a2d15932ed663a486cde36583e645d2
SHA256

0a4c576caf754fb24ffac0da96e65d969a1c50dca3dd9e4c7563d5f0bdca7d33
SHA512

7731020e48b4f7545787b345436ef82fad60bb74c53f0f736454e4b32d624d1de137bca57dc98b8ad1a106057f1c2b1c81567d0616a3fb9263d8ef1434a21c6d
SSDEEP

1536:mFtIK9rv2TCHedTTcSVHPu8YqpsASlOroUE74mq:+tIK9rv222sQWbLASYroUw4l

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3316 wrote to memory of 1476	3316	rundll32.exe	84
PID 3316 wrote to memory of 1476	3316	rundll32.exe	84
PID 3316 wrote to memory of 1476	3316	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f139dbf8e8441cb2d314096dfc9ec3e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3316
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f139dbf8e8441cb2d314096dfc9ec3e_JaffaCakes118.dll,#1
  2⤵
  PID:1476