c31faa97d477ade828f32220b76131c2a91cd0a99add8506d39c0dccc91b538d

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 14:37

Target

42184403e921614e0e210d8cd2d9e20f_JaffaCakes118.dll
Size

8KB
MD5

42184403e921614e0e210d8cd2d9e20f
SHA1

591e34626eb663ce35fb206a93231acd2940fdd7
SHA256

c31faa97d477ade828f32220b76131c2a91cd0a99add8506d39c0dccc91b538d
SHA512

ad8fb650a2420d0d0492e813b7a53e587df1b4cd7535122ac25ee9220b424de1455564e4faf7c81f6f70669c55ce983aec2233e562d4ffc97348d3e35100e924
SSDEEP

96:ITByInNTCdUDbGL4XfrUSJ+s2/qpgf3X3X3diHtn2GPH8FixzOTCR:NInNTCdUDbGIfrJ+sGCgF8nZPDzOTC

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 2536	4572	rundll32.exe	83
PID 4572 wrote to memory of 2536	4572	rundll32.exe	83
PID 4572 wrote to memory of 2536	4572	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\42184403e921614e0e210d8cd2d9e20f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\42184403e921614e0e210d8cd2d9e20f_JaffaCakes118.dll,#1
  2⤵
  PID:2536