c3656654cd41a7879b1c44a319c9c5cdee5db987954539b15394551dd1cf664f

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
26-06-2024 12:49

Target

1203b89909619a636ea2b58cd7d6ca09_JaffaCakes118.dll
Size

330KB
MD5

1203b89909619a636ea2b58cd7d6ca09
SHA1

45660a02b201e5c08183290cf38ea0b3518190f3
SHA256

c3656654cd41a7879b1c44a319c9c5cdee5db987954539b15394551dd1cf664f
SHA512

e28474fe5efc21fc344a542f7804e1067b563ed526d23e8d0438aa097df9785c13525a278d4c10e88e0a596580ead26b188d5a8450cd6260abbdccd909071703
SSDEEP

3072:IRq1sFAd2gQ5PmBvNZwnnq1gn2RvoXiDzAYgrO1v2F5j8eFu:Sq1sFAwgwmBv3wnIgG4oAYxvU54eu

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4876 wrote to memory of 960	4876	rundll32.exe	rundll32.exe
PID 4876 wrote to memory of 960	4876	rundll32.exe	rundll32.exe
PID 4876 wrote to memory of 960	4876	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1203b89909619a636ea2b58cd7d6ca09_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4876

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1203b89909619a636ea2b58cd7d6ca09_JaffaCakes118.dll,#1
2⤵
PID:960