117a360e56275a8e9f952127e49589101e9c32615be100c3465d6056f70ea2e7

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16/07/2024, 01:25

Target

4c3d31a3bf9e1b58c3b9b409554d4665_JaffaCakes118.dll
Size

31KB
MD5

4c3d31a3bf9e1b58c3b9b409554d4665
SHA1

1bcabbe659fbce134f40a3f9443a6b97b70e6feb
SHA256

117a360e56275a8e9f952127e49589101e9c32615be100c3465d6056f70ea2e7
SHA512

6d3daef13c868fef94e66ac42466012f3c5603712abb6e7ebbb131d064252501bb1b20c5cbe17fda5b878cdf9f736626c9dd56a42c077d435a5527619baa6525
SSDEEP

768:qYJWA1CqWe0PamHQ267tM/AChqDERIEZ8T:7kA1kPamM7tEhkYRIEZE

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3984 wrote to memory of 4500	3984	rundll32.exe	85
PID 3984 wrote to memory of 4500	3984	rundll32.exe	85
PID 3984 wrote to memory of 4500	3984	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c3d31a3bf9e1b58c3b9b409554d4665_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c3d31a3bf9e1b58c3b9b409554d4665_JaffaCakes118.dll,#1
  2⤵
  PID:4500