5f959db43830f1a7eeeb705767d7d5e088c57713decd167b4f3692a1475f0248

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 00:35

Target

3b55afa538c826b45ce973fa1dc1e00e_JaffaCakes118.dll
Size

184KB
MD5

3b55afa538c826b45ce973fa1dc1e00e
SHA1

7bed6ef5d8455211b4a7c6fab2fd83530858a229
SHA256

5f959db43830f1a7eeeb705767d7d5e088c57713decd167b4f3692a1475f0248
SHA512

5e7c9d0a64cc74f3377947281ba59607eaeef02bdd37df06c9b51aff6c8ef2aa30d5b77d49c0243f219471bceb5eb382d7de310dc29327bd0e1cea0a5cd4e405
SSDEEP

3072:QqVqbjefAnS4z4JENucY24cLgBvoPnkcCZTaDTrUh/rrQBHX9AdwqvqyGoT:DVqfbz5NRDCBgPkcCZTaXrUtoBHtklv+

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 100 wrote to memory of 3140	100	rundll32.exe	83
PID 100 wrote to memory of 3140	100	rundll32.exe	83
PID 100 wrote to memory of 3140	100	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b55afa538c826b45ce973fa1dc1e00e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:100
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b55afa538c826b45ce973fa1dc1e00e_JaffaCakes118.dll,#1
  2⤵
  PID:3140