333ff3b2d3478d576ec0bf996acd230788109e6bcac25845ab6d4ebce0077f83

Analysis

max time kernel
94s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 09:00

Target

3cbc324041bfea07cc70cfc8a955ca9a_JaffaCakes118.dll
Size

45KB
MD5

3cbc324041bfea07cc70cfc8a955ca9a
SHA1

40340512fbb5d2de20ee039b95013aa0d851f043
SHA256

333ff3b2d3478d576ec0bf996acd230788109e6bcac25845ab6d4ebce0077f83
SHA512

1e6bf2d22cb033d34d65f68eb03677a8e2f0acfd6fc7ce620144aa7ba02b1c29db104620da982b9b6bbb3b9057067c4c1d470cd6b210aa6844919fe4c6458725
SSDEEP

768:BS7MqklszD1jD95N9ar6WGYnAmZ+z2xkXMTbR0qJvJJ3Ra6qoH7oprD0GaJUN:Y7MqklsXzKQYnAmZ+zLMB3Ra6bosUN

Score

1^/10

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3668 wrote to memory of 4964	3668	rundll32.exe	83
PID 3668 wrote to memory of 4964	3668	rundll32.exe	83
PID 3668 wrote to memory of 4964	3668	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3cbc324041bfea07cc70cfc8a955ca9a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3668
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3cbc324041bfea07cc70cfc8a955ca9a_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4964