5bbadef715235df3a03815edb7c4e5988c6f24e8dc76010a472ee890edcc83a8

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 21:39

Target

321344dd5319d5bfd9b6c1ddc372f22c_JaffaCakes118.dll
Size

61KB
MD5

321344dd5319d5bfd9b6c1ddc372f22c
SHA1

cfa03fc0aa5f463a22896e54f7dde1ae48cc91cb
SHA256

5bbadef715235df3a03815edb7c4e5988c6f24e8dc76010a472ee890edcc83a8
SHA512

955e89fa61a8bef420a8736bfb6da455900aab30686f9b0d9b531cdae1a479600a5997cf49d44160e665492a44c9ca361f0566f20e06c06225336fb5b5e78b42
SSDEEP

1536:0+4hdsDYTVD3W4mBZABOEj74HSv9T21obmoy:0+IsDYhqDzDvHy9T21obe

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3116 wrote to memory of 3952	3116	rundll32.exe	81
PID 3116 wrote to memory of 3952	3116	rundll32.exe	81
PID 3116 wrote to memory of 3952	3116	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\321344dd5319d5bfd9b6c1ddc372f22c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3116
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\321344dd5319d5bfd9b6c1ddc372f22c_JaffaCakes118.dll,#1
  2⤵
  PID:3952