bb2ee9a061132cb5967864053691f73394d776b8359241540ac37774c6f9ac4e

Analysis

max time kernel
93s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 01:46

Target

32d697f099fecabbc3400257c188488f_JaffaCakes118.dll
Size

33KB
MD5

32d697f099fecabbc3400257c188488f
SHA1

9cbdbb87dc8a3df0dde16b3ea3afebc1afb2079d
SHA256

bb2ee9a061132cb5967864053691f73394d776b8359241540ac37774c6f9ac4e
SHA512

8a18bb38954b80a86b2e90c4c26fdd69747930ebb5bb8ea8defeee25b290b59470002af5d4c62e93bb8134b2e49ede705ab350cc9a3969880d2e8ce2d1f772c6
SSDEEP

768:GPC39bq5oxE2AdR40kYO2lg7EW1DdgI5hqDMTR5b+X:GPwgAEw0kY87EWddgWk+Rd+X

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 3084	4500	rundll32.exe	81
PID 4500 wrote to memory of 3084	4500	rundll32.exe	81
PID 4500 wrote to memory of 3084	4500	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\32d697f099fecabbc3400257c188488f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\32d697f099fecabbc3400257c188488f_JaffaCakes118.dll,#1
  2⤵
  PID:3084