24098125586b78c347991de3b0390b15ea1b1b840ebe5738c0dda358a4bcd9ea

Analysis

max time kernel
93s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 16:22

Target

357abfeee25ff066640df60f1c032196_JaffaCakes118.dll
Size

34KB
MD5

357abfeee25ff066640df60f1c032196
SHA1

6ec26f6cf4d7a7afc71024730f7e25098d043d95
SHA256

24098125586b78c347991de3b0390b15ea1b1b840ebe5738c0dda358a4bcd9ea
SHA512

50c4585113698b4411f636d6e2ffe54b3c0520ad81eecf4cb1f33a4bc9b49769a969aa4c7149d9ad4df7580f33193fcf95fa0b190eabf94308c0d4b751cf084c
SSDEEP

384:l/rFBUlxe5wRI0f06NZ6hEe9zJtMkMT7Nm63PInHxSIVIeRunYPLds41eMmT:l/R0e2RI0s6NiPbWQ6l4IeRu7

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 2016	1928	rundll32.exe	81
PID 1928 wrote to memory of 2016	1928	rundll32.exe	81
PID 1928 wrote to memory of 2016	1928	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\357abfeee25ff066640df60f1c032196_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\357abfeee25ff066640df60f1c032196_JaffaCakes118.dll,#1
  2⤵
  PID:2016