91f23710db43797b091587ad10bd595866fd7e0b2ec3d433bb60f3907dd06986

Analysis

max time kernel
94s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 20:00

Target

3eb0207aee15bb55c510dc36d7ade710_JaffaCakes118.dll
Size

28KB
MD5

3eb0207aee15bb55c510dc36d7ade710
SHA1

f1e172a71d1d67a97f9d14e38ced2c6607e8fac7
SHA256

91f23710db43797b091587ad10bd595866fd7e0b2ec3d433bb60f3907dd06986
SHA512

266a1c445c04c9e0d5b9c0070027cc16e69f5f0fccd08dae80348129577aa904e5b93523443492e7df3154d1d0b73f670474835e1f0274622294f80af1668cee
SSDEEP

96:I+RyuJU29DG1qN/T2+232+QAdeutQ1gEQyepnZ:RRyIU29DG1qh8gAIh5Ng

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1836 wrote to memory of 2852	1836	rundll32.exe	83
PID 1836 wrote to memory of 2852	1836	rundll32.exe	83
PID 1836 wrote to memory of 2852	1836	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3eb0207aee15bb55c510dc36d7ade710_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1836
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3eb0207aee15bb55c510dc36d7ade710_JaffaCakes118.dll,#1
  2⤵
  PID:2852