264a0ccab6f0f6d9f99affbcf8c10a8d268989b27454ed3511c2b68fa4056095

Analysis

max time kernel
95s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 21:33

Target

436d0edfb481e43494dc0be81c8ea82e_JaffaCakes118.dll
Size

72KB
MD5

436d0edfb481e43494dc0be81c8ea82e
SHA1

8af89c48f3fb48c76de3a36fd76b1fe02a8f6b19
SHA256

264a0ccab6f0f6d9f99affbcf8c10a8d268989b27454ed3511c2b68fa4056095
SHA512

efa41a2588bad94570374396931c37308a01732e45b1e0e67c9a6508585503a47e289683f5926f0d69ea75d3c76af7ede86f8a283de86e3694288b3a2714654f
SSDEEP

1536:J5fRZL8hjUTNol1oB3FMGR4+z04RE9orog4W1M:J5fDgu9+mWaE9osgP1M

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 3380	1032	rundll32.exe	83
PID 1032 wrote to memory of 3380	1032	rundll32.exe	83
PID 1032 wrote to memory of 3380	1032	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\436d0edfb481e43494dc0be81c8ea82e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\436d0edfb481e43494dc0be81c8ea82e_JaffaCakes118.dll,#1
  2⤵
  PID:3380