05ffc0937e0ee0a8eda08f732fd3ee6854b12f182d64b682086526b889950e7f

Analysis

max time kernel
32s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 02:43

Target

3766da7c9a27889b91c84d421f504fd0_JaffaCakes118.dll
Size

27KB
MD5

3766da7c9a27889b91c84d421f504fd0
SHA1

9d32f6537fd37df9a139e1bd752a0641791c957e
SHA256

05ffc0937e0ee0a8eda08f732fd3ee6854b12f182d64b682086526b889950e7f
SHA512

9e007a7d10a76d8bf9195b9a94b13d1ad2469f16414b849a6064d308b11f1e32b16f27458f9d9123dabdeb83f96b58f5fb805ad68b027e08ffc1696509bc3b01
SSDEEP

384:RKlR1OPBtWnxgydURqxSeanQay8oog6wnv62PLD9RecCn2MlDpYD72ObjjjHqj:kUIZdeqx9aQd8ooG62zD9c7uD72y7K

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 4816	2904	rundll32.exe	81
PID 2904 wrote to memory of 4816	2904	rundll32.exe	81
PID 2904 wrote to memory of 4816	2904	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3766da7c9a27889b91c84d421f504fd0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3766da7c9a27889b91c84d421f504fd0_JaffaCakes118.dll,#1
  2⤵
  PID:4816