dfbdfa0d087b8e67f1e265cd0cead11aa7fd713e38d817f672d0cc5dcf1d34e6

Analysis

max time kernel
93s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 15:29

Target

39b3df0c57015f84fefd8e3114abc990_JaffaCakes118.dll
Size

48KB
MD5

39b3df0c57015f84fefd8e3114abc990
SHA1

da448e4b19321f0f019cca8d51a1d8446fb728ad
SHA256

dfbdfa0d087b8e67f1e265cd0cead11aa7fd713e38d817f672d0cc5dcf1d34e6
SHA512

c4235689806b912e3cbf0289c3654c8e6800108b26d81bf3f3009abb44e1aa015aa5100a951116fc906fedd092e051ff6f03f7f91916f5ddc2cce385d67e4aee
SSDEEP

768:cQuYaT2Op1/TGc0TcPAyRbe7FNMwuv/ydjOfy+W9w3o2:chzF0YiZNMv3ydjOfKw4

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 2640	1280	rundll32.exe	83
PID 1280 wrote to memory of 2640	1280	rundll32.exe	83
PID 1280 wrote to memory of 2640	1280	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\39b3df0c57015f84fefd8e3114abc990_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\39b3df0c57015f84fefd8e3114abc990_JaffaCakes118.dll,#1
  2⤵
  PID:2640