958a91e12942274e1dcd7009f9330ce1c67c50363a8796e975732f647cba2232

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 22:14

Target

369c4ae002f77b402b9007de5976ce72_JaffaCakes118.dll
Size

32KB
MD5

369c4ae002f77b402b9007de5976ce72
SHA1

bdee3731f5b6134be4cdde1de1bce0294259737d
SHA256

958a91e12942274e1dcd7009f9330ce1c67c50363a8796e975732f647cba2232
SHA512

76ae360b52723c43e2645ddc3ac279a7f570f2a3112a274145088c26989443326fbc8e66b98b0be551b4a7b0b10b064fc67b8b7f44f1a4224e1258180e71fe5f
SSDEEP

768:D24K7MjWs6CKSbjsFk+7grzrDN1hVf6ZyZsUr:D24cY5KSs7gHrDrHUyZs8

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 3876	1036	rundll32.exe	83
PID 1036 wrote to memory of 3876	1036	rundll32.exe	83
PID 1036 wrote to memory of 3876	1036	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\369c4ae002f77b402b9007de5976ce72_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\369c4ae002f77b402b9007de5976ce72_JaffaCakes118.dll,#1
  2⤵
  PID:3876