44cf465290af7c0aca6782c30a5a6e37526efe5dc9a935fbf1cf3bacc8e6589c

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12-07-2024 21:22

Target

3eee57eed73a32075e150161980b2cef_JaffaCakes118.dll
Size

126KB
MD5

3eee57eed73a32075e150161980b2cef
SHA1

518666cda012cc5e07c725564eb8eb7841609f94
SHA256

44cf465290af7c0aca6782c30a5a6e37526efe5dc9a935fbf1cf3bacc8e6589c
SHA512

0a36633597051cf71d244e04bf637228458b1ba660bbeba406ea3b2f05f057ae26d69c59cf135207693edbfda040df185ed34859284a70fb606279d0b242aec7
SSDEEP

3072:a6T+1r43p/oyukeTcxG1rAYjkPD5RcdqqGPkU5uCClnC9:AaApTcxsUedqkU5g

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3292 wrote to memory of 4144	3292	rundll32.exe	83
PID 3292 wrote to memory of 4144	3292	rundll32.exe	83
PID 3292 wrote to memory of 4144	3292	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3eee57eed73a32075e150161980b2cef_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3292
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3eee57eed73a32075e150161980b2cef_JaffaCakes118.dll,#1
  2⤵
  PID:4144