5fb6f8ddd561f718d7f3033fd076ec310a6dba7b19763b46ca337af72ef4fd29

Analysis

max time kernel
32s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 03:51

Target

33331b8b71ad010e2aa79041322357ca_JaffaCakes118.dll
Size

73KB
MD5

33331b8b71ad010e2aa79041322357ca
SHA1

480c682495854c2e5eaa8d30b21743452fb5347a
SHA256

5fb6f8ddd561f718d7f3033fd076ec310a6dba7b19763b46ca337af72ef4fd29
SHA512

975326778ee731f0f2c3e9903f842723f736e29ff3916695e2375f31f969e2f4f37d7efa18fbb68d44120c6418ac0a0fe681c82afb6cc544a7e06358bfbc3061
SSDEEP

1536:bUJoi413PFIrwoIFXe3FxwCbKjWqLHVbbi0kiEAd81B/lxz:bOK13PFI+Xe3FxwTlmiJd+/lxz

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 4308	4572	rundll32.exe	80
PID 4572 wrote to memory of 4308	4572	rundll32.exe	80
PID 4572 wrote to memory of 4308	4572	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\33331b8b71ad010e2aa79041322357ca_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\33331b8b71ad010e2aa79041322357ca_JaffaCakes118.dll,#1
  2⤵
  PID:4308