f359515cc3573e293e32c0e354cc7971242b6e7d7122eab816073a0405fc269c

Analysis

max time kernel
134s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27-06-2024 17:30

Target

16dfc263282fd8a270bb1e4c4830b612_JaffaCakes118.dll
Size

330KB
MD5

16dfc263282fd8a270bb1e4c4830b612
SHA1

143092c9e1718240e3d1ad59fd11bbc579859e90
SHA256

f359515cc3573e293e32c0e354cc7971242b6e7d7122eab816073a0405fc269c
SHA512

dbe443d85ffd0c06f4990f3da3fa8e10cccdb1402e9be422b464a8f987579766d27ac585a4149f93961650d7c427e8eb9c0470cc202a35e69cd87a75180ba2bb
SSDEEP

3072:xRq1sFAd2gQ5PmBvNZwnnq1gn2RvoXiDzAYgrO1v2F5j81qc:zq1sFAwgwmBv3wnIgG4oAYxvU54gc

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2240 wrote to memory of 320	2240	rundll32.exe	rundll32.exe
PID 2240 wrote to memory of 320	2240	rundll32.exe	rundll32.exe
PID 2240 wrote to memory of 320	2240	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\16dfc263282fd8a270bb1e4c4830b612_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2240

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\16dfc263282fd8a270bb1e4c4830b612_JaffaCakes118.dll,#1
2⤵
PID:320