16a3c3f2f099756e88675ff99fbec7f634c134ad38467a7d53da2049657efde3

Analysis

max time kernel
139s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22-07-2024 18:00

Target

6435593504d84f44e274d9d79a10e111_JaffaCakes118.dll
Size

32KB
MD5

6435593504d84f44e274d9d79a10e111
SHA1

9eba2872b8c7c13fbd70a363691f3490fdd43362
SHA256

16a3c3f2f099756e88675ff99fbec7f634c134ad38467a7d53da2049657efde3
SHA512

551c1da1f142515a6cd6cf496f5cea57b74d9845897c72171168f9ce1e49c0cf22c2e5e42d355baf5d45128800aff40261b761c10edb90cea7f39dd246324831
SSDEEP

768:NIvZDUmk0z8sMUV730d7SmbZyGqOI+RqSTIn:NIBDUPgiUV7E7SmtsMRjM

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 952 wrote to memory of 5048	952	rundll32.exe	84
PID 952 wrote to memory of 5048	952	rundll32.exe	84
PID 952 wrote to memory of 5048	952	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6435593504d84f44e274d9d79a10e111_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6435593504d84f44e274d9d79a10e111_JaffaCakes118.dll,#1
  2⤵
  PID:5048