43e7afa032c8e33de1c9c5704729dd1ed703eb672e5fb8f0609e5fae8951fd56

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12-07-2024 23:47

Target

3f5b269a1c340804d4c41f4b3f70f0d9_JaffaCakes118.dll
Size

228KB
MD5

3f5b269a1c340804d4c41f4b3f70f0d9
SHA1

72125c2fe834c3cdeaaba7070ca36c7976148008
SHA256

43e7afa032c8e33de1c9c5704729dd1ed703eb672e5fb8f0609e5fae8951fd56
SHA512

72fd516faee077e425943fd1e88fb042a4f7e77c51b0592230fbf6b9cf3d526818659aa718e07f30e44a24499c252f0afacc0299f9aaf80c6c37463f9106de96
SSDEEP

3072:5/NrMHpfUkW+AvBMG6G38ZIVOd42ne/X9A/epHp4ks5yyU+pfr12h6e:ZdMJ8kW+AvBMG6G38m4T+9teEv

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3852 wrote to memory of 1236	3852	rundll32.exe	83
PID 3852 wrote to memory of 1236	3852	rundll32.exe	83
PID 3852 wrote to memory of 1236	3852	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f5b269a1c340804d4c41f4b3f70f0d9_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3852
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f5b269a1c340804d4c41f4b3f70f0d9_JaffaCakes118.dll,#1
  2⤵
  PID:1236