81557259a69a2052d74fbd640570ca91911ba895c36aa48094e78b56dbc9722d

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11-07-2024 06:05

Target

37fa5764b3d97f8ecc1fc88800907372_JaffaCakes118.dll
Size

33KB
MD5

37fa5764b3d97f8ecc1fc88800907372
SHA1

cb60c7b26906f7e5378b554f83cf21e930c11316
SHA256

81557259a69a2052d74fbd640570ca91911ba895c36aa48094e78b56dbc9722d
SHA512

a0a2d86ce32363863c29a0deab3fdf7eac4b04bc9a436fb3dfa89b19bf0055b6ae776fc6fd39a82ec51ecf1cf85a2c6d1aeb71e6ee5f52bfb5c7c182cc3dd038
SSDEEP

768:lMfGZwZRWH0f6uv+R74BufMSVOk8GRhF4G:lAGZkm0n274BufVhRF

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3716 wrote to memory of 2356	3716	rundll32.exe	83
PID 3716 wrote to memory of 2356	3716	rundll32.exe	83
PID 3716 wrote to memory of 2356	3716	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\37fa5764b3d97f8ecc1fc88800907372_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\37fa5764b3d97f8ecc1fc88800907372_JaffaCakes118.dll,#1
  2⤵
  PID:2356