3b009c6a4f205d1037dd1f08bcc30ef9a34e12c048815693e7747fa6a9b6e7c5

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12-07-2024 20:58

Target

3edbe6fddfe4cb597ec0a30be09bc013_JaffaCakes118.dll
Size

137KB
MD5

3edbe6fddfe4cb597ec0a30be09bc013
SHA1

902dd3ab4188ea4902c030dbc4605ec3b7a195e0
SHA256

3b009c6a4f205d1037dd1f08bcc30ef9a34e12c048815693e7747fa6a9b6e7c5
SHA512

2bddc560d77e675b47644090ad430c307938b22815bbf0eafc8daa9d8049025fc98b95f7332e7937f6ca3a428265f2b2e794e2db8724e31a74c21ea9ac0096b7
SSDEEP

3072:IWp36jFpsIuo3c1OK+yBaMm31obl4vZwgmvchZ7lWz90+4W0:IWpKjzuo3vMpblFOMzu33

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 3176	1408	rundll32.exe	83
PID 1408 wrote to memory of 3176	1408	rundll32.exe	83
PID 1408 wrote to memory of 3176	1408	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3edbe6fddfe4cb597ec0a30be09bc013_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3edbe6fddfe4cb597ec0a30be09bc013_JaffaCakes118.dll,#1
  2⤵
  PID:3176