58e99a36518aab1393da169dab8de9ae6afe86e8e831269fc1d880ac959bc7a5

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 19:26

Target

36110e9f5ed07ac2df932322f0238d06_JaffaCakes118.dll
Size

135KB
MD5

36110e9f5ed07ac2df932322f0238d06
SHA1

d4fe4cb3c0dcac5744087e075e542a417c034871
SHA256

58e99a36518aab1393da169dab8de9ae6afe86e8e831269fc1d880ac959bc7a5
SHA512

768bf89338fd4b02a9840c7b5499d12fbab1422ed21b8bd3e8b8db0d0a8ade6959851f6f1a14542582e82ea917bb9de73ddf0d27d8c39420e58cb253ee038b13
SSDEEP

3072:E6qj0gOJSyeH9V4jUgmXs7M49f0FvlyHvpkXGSCk+RgNJJI:iWJZ6n45Ks7MUfAyHBFSb+RwJ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 4716	5072	rundll32.exe	83
PID 5072 wrote to memory of 4716	5072	rundll32.exe	83
PID 5072 wrote to memory of 4716	5072	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\36110e9f5ed07ac2df932322f0238d06_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\36110e9f5ed07ac2df932322f0238d06_JaffaCakes118.dll,#1
  2⤵
  PID:4716

memory/4716-0-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download