05868ed1f31bba553b4def5914a4cde72acd22e39bf1d2410b40e416c7eb9504

Analysis

max time kernel
133s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 01:59

Target
37a96600fdac44473db16d7610979e31_JaffaCakes118.dll
Size 117KB
Sample240512-ceweesbb9s
SHA256 05868ed1f31bba553b4def5914a4cde72acd22e39bf1d2410b40e416c7eb9504
MD5 37a96600fdac44473db16d7610979e31
SHA1 595869e055be05773a150114d01d18f22cc3ca1c
SHA512 5f9b1c6aba7a5c9fc56137886eca331db089ffa74df4f913eabcf332aab2a8d4a7aa2964c695637adf766f0f0793a537ba4bf7b2eea13a5720766d89c2c95304
SSDEEP 3072:ka9gYob8n2rsGzQDBZLHr+eZgHjifgxZy:P9gs2QGzmRYjG
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4668 wrote to memory of 1712	4668	rundll32.exe	84
PID 4668 wrote to memory of 1712	4668	rundll32.exe	84
PID 4668 wrote to memory of 1712	4668	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\37a96600fdac44473db16d7610979e31_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4668
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\37a96600fdac44473db16d7610979e31_JaffaCakes118.dll,#1
  2⤵
  PID:1712