3d58eff9b2cbaff006e1631538ba8306edc82f27303a9fb75e876096a69de343

Analysis

max time kernel
136s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
16/07/2024, 02:13

Target

4c6512e0490d7ade810a169afebac9eb_JaffaCakes118.dll
Size

140KB
MD5

4c6512e0490d7ade810a169afebac9eb
SHA1

e2ae699e553d2b4634482e047795d7e519ae0d22
SHA256

3d58eff9b2cbaff006e1631538ba8306edc82f27303a9fb75e876096a69de343
SHA512

345bc92db2dfda752136b05f35a67681a43ab9aeb317e0230ad63bfbcd3eff2c313ddcb77ca038f216346f637d950a23c581be963d90481d3d1e39828409c54d
SSDEEP

3072:JtaumjjUOuF34YKYARTymyKVvPD8j43YpB:rausUOua+ARmmv+

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3952 wrote to memory of 4208	3952	rundll32.exe	83
PID 3952 wrote to memory of 4208	3952	rundll32.exe	83
PID 3952 wrote to memory of 4208	3952	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c6512e0490d7ade810a169afebac9eb_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c6512e0490d7ade810a169afebac9eb_JaffaCakes118.dll,#1
  2⤵
  PID:4208