c9f5f05b0dd55796b5f7523cd8488b688c109cea6d4b3a99a8ccffc8f7042fcc

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 14:35

Target

3dc6cb7a1bc9d018c8d82cf9b124fd22_JaffaCakes118.dll
Size

29KB
MD5

3dc6cb7a1bc9d018c8d82cf9b124fd22
SHA1

2f5c7594c557f6d2992b4f4f667fd41c67e1a0f3
SHA256

c9f5f05b0dd55796b5f7523cd8488b688c109cea6d4b3a99a8ccffc8f7042fcc
SHA512

60d1925164c4c377165a284067d9f806f95b981f3f3e1ec2ef878a1c92079d9e502108a8369779c2cf75c85d2b669637d002717717fb0ac98cf784e240db6e8f
SSDEEP

384:kDfY81aJbML9gvdFOdTm9SW290Wnbebk21XaaZFDlRnoa/uGqdTUkk:kDfY81aJbML9gbOd/ZaZFZRnx7qSv

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3996 wrote to memory of 1800	3996	rundll32.exe	83
PID 3996 wrote to memory of 1800	3996	rundll32.exe	83
PID 3996 wrote to memory of 1800	3996	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3dc6cb7a1bc9d018c8d82cf9b124fd22_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3dc6cb7a1bc9d018c8d82cf9b124fd22_JaffaCakes118.dll,#1
  2⤵
  PID:1800