37fcebbe0681a204a3283c1dee47cac0d955c819c3f7d3f187dc61bd1a662869

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16/07/2024, 01:24

Target

4c3c94e0db265fd8caa9980204bca3f3_JaffaCakes118.dll
Size

38KB
MD5

4c3c94e0db265fd8caa9980204bca3f3
SHA1

e60c07491ece2a452c947cf09efe0d02c5b58204
SHA256

37fcebbe0681a204a3283c1dee47cac0d955c819c3f7d3f187dc61bd1a662869
SHA512

d1d5244bfb936a63620cf1abbb1eedb7c02457f621985858578b44347fae801b850c203a4e53e8908d8e08a690cbe0c91941947925b6dbb3e5a239cf73494203
SSDEEP

768:Lt2YH5sl4woC/8ehij9al+72frDXNSGijYRDtF3hH/T:Zj5sl0CphijQg72frsLYRDtFxHr

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 3576	1192	rundll32.exe	83
PID 1192 wrote to memory of 3576	1192	rundll32.exe	83
PID 1192 wrote to memory of 3576	1192	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c3c94e0db265fd8caa9980204bca3f3_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c3c94e0db265fd8caa9980204bca3f3_JaffaCakes118.dll,#1
  2⤵
  PID:3576