87fffebfa1a70c1208e77785740e91f8b8198fdc3e8da5345940a420c845c89c

Analysis

max time kernel
104s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 11:10

Target

3d21bb5cb063322d358de574e52febb6_JaffaCakes118.dll
Size

36KB
MD5

3d21bb5cb063322d358de574e52febb6
SHA1

adb7b838114fa2d7aa7cbbc8a752fde8b74bb01d
SHA256

87fffebfa1a70c1208e77785740e91f8b8198fdc3e8da5345940a420c845c89c
SHA512

f3ede55c2da1d0ad5e5a235b670bbf3d4f3eb30ee019e34343695aafb3654a09f7be375813a4f86303deb49daa5689e3659fb61b194f69a2506f96aa79e133fe
SSDEEP

384:sh30Pba3lwcPP3gKCAI0roaa6R1i69M/EHVSxTWgokamYtcIymtWApcxfZf4993g:sh5WgTvaC1rqsA1wrtWAaBZnKW

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 776 wrote to memory of 1612	776	rundll32.exe	83
PID 776 wrote to memory of 1612	776	rundll32.exe	83
PID 776 wrote to memory of 1612	776	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d21bb5cb063322d358de574e52febb6_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:776
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d21bb5cb063322d358de574e52febb6_JaffaCakes118.dll,#1
  2⤵
  PID:1612