04f8c190fa2a5d2c5714e5e0a4d0aa381e2c4f85c514542f5db135ea1a4400b8

Analysis

max time kernel
143s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12-07-2024 18:12

Target

3e5a632667c43eeacb1924fe55fdc13f_JaffaCakes118.dll
Size

33KB
MD5

3e5a632667c43eeacb1924fe55fdc13f
SHA1

961e3bb981dadc5863c10df4278c9c7d4cd4d145
SHA256

04f8c190fa2a5d2c5714e5e0a4d0aa381e2c4f85c514542f5db135ea1a4400b8
SHA512

d19cee73b7bdf52fa2815344e33f350e257019348e710f26b0315a757c2c89f8bd79cfe6685abd15abbaa1704a7c1db18311dedef0854e80e1d8c9a62a399327
SSDEEP

768:sCpRVdQUaUrHy4Kr/Ai5m7EiEAdMSVOc4RLB85:sCp7dQUaU24KrA7EiEAdV6R0

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 3560	4908	rundll32.exe	85
PID 4908 wrote to memory of 3560	4908	rundll32.exe	85
PID 4908 wrote to memory of 3560	4908	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3e5a632667c43eeacb1924fe55fdc13f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3e5a632667c43eeacb1924fe55fdc13f_JaffaCakes118.dll,#1
  2⤵
  PID:3560