88e5d7b5706b74f24046d92dfdfa0dfe05c5c203816eb31d0d0a2015fa929070

Analysis

max time kernel
120s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 22:27

Target

36a5d35852ab9fadc7b66499772ea064_JaffaCakes118.dll
Size

31KB
MD5

36a5d35852ab9fadc7b66499772ea064
SHA1

096ef9b3127d907260f2c2c7ab00fa2ab1330512
SHA256

88e5d7b5706b74f24046d92dfdfa0dfe05c5c203816eb31d0d0a2015fa929070
SHA512

fd661edabca9cd4b0b7a9d4179c4af1afa51a98ed6c209152c1b63f9af6c74b0ea0aa9b25e4aa531ecd5124c599201c562f7ae081388a878c5d208e08c6b74a9
SSDEEP

768:Ot+TY5Vv6AyUfiW3EPFrZ8f+bvrqSc8uaUtZQAVDN1/n:OtY0VC1UfiW38FrZ8Wbv+Sw1BT/

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 1632	1756	rundll32.exe	83
PID 1756 wrote to memory of 1632	1756	rundll32.exe	83
PID 1756 wrote to memory of 1632	1756	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\36a5d35852ab9fadc7b66499772ea064_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\36a5d35852ab9fadc7b66499772ea064_JaffaCakes118.dll,#1
  2⤵
  PID:1632