35c7e9ca2cec155509a03a67e672c39bea058c1858b8752f8f3a38255480ebed

Analysis

max time kernel
141s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22-07-2024 13:46

Target

6368d7e4f37695c7519ffcb3f1958ef6_JaffaCakes118.dll
Size

128KB
MD5

6368d7e4f37695c7519ffcb3f1958ef6
SHA1

165015b27ea269c76852c6b155ac7028279d4eac
SHA256

35c7e9ca2cec155509a03a67e672c39bea058c1858b8752f8f3a38255480ebed
SHA512

a65f18a04bb803ad6cf14f2e73aeeebb08b9c1e8db34520f69eec44bec4da709229991bd4d9d0d5b94c10b96bb26b16184c848d5fe63a07c7d08872e363786e9
SSDEEP

3072:J4NLn5ECrxwq4gzgVhaNhfxGaHhBt6FHwjOTU:JYwQzgra/wekFHwqo

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3908 wrote to memory of 2860	3908	rundll32.exe	84
PID 3908 wrote to memory of 2860	3908	rundll32.exe	84
PID 3908 wrote to memory of 2860	3908	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6368d7e4f37695c7519ffcb3f1958ef6_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6368d7e4f37695c7519ffcb3f1958ef6_JaffaCakes118.dll,#1
  2⤵
  PID:2860