99b5785fd3b9f6ca51a2742857badee1579a57410f83a3ed0c62c10a47787a73

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
09-07-2024 15:02

Target

30dbaa987fc03453f2e97afebc850672_JaffaCakes118.dll
Size

56KB
MD5

30dbaa987fc03453f2e97afebc850672
SHA1

d0c35c4245617b1c922d006c7c222cdb727413d6
SHA256

99b5785fd3b9f6ca51a2742857badee1579a57410f83a3ed0c62c10a47787a73
SHA512

ab16fed433213e6cc0e7ad155911a6d3c2e5ea4a3b8438e8c230049404350f9507dd0b6580e6b36cefda8c52af26ec4f8098015344f2002533c4e87e1d99fff6
SSDEEP

768:gX2uZzEo8fwr+vycHQwhD28jyrAwo9w1dehtSrcmv6eVA9ABrpHDE:62uRE5f8+vptd28erok3LA9ABlHD

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 780 wrote to memory of 2656	780	rundll32.exe	79
PID 780 wrote to memory of 2656	780	rundll32.exe	79
PID 780 wrote to memory of 2656	780	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\30dbaa987fc03453f2e97afebc850672_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:780
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\30dbaa987fc03453f2e97afebc850672_JaffaCakes118.dll,#1
  2⤵
  PID:2656

memory/2656-1-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/2656-0-0x0000000010002000-0x0000000010003000-memory.dmp

Filesize
4KB

Download