0b92063bf300aba1317551af2c64160090aa54e859ffb6c24e2c0d30ac76c322

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 15:31

Target

39b530c37d033974e91edf653e6583af_JaffaCakes118.dll
Size

33KB
MD5

39b530c37d033974e91edf653e6583af
SHA1

4f54806edfbb4162c66b0cab8ac20f04999fe7b2
SHA256

0b92063bf300aba1317551af2c64160090aa54e859ffb6c24e2c0d30ac76c322
SHA512

37b4a0073e6e17cc3018703a842cc37d76d0908b6e28e1efd23b5746a512559fb875221d32ba24aadf5b31d37369c0201fb3ebc94b2c4143cf40e36d1a39c068
SSDEEP

768:8zvBbTuLpesvPLmrKIUHbFak79MV7yY5c5hcDXsqgR3z5Dob:8zvBbTuLpe4mcFakG7yGCC7sqgRj5D8

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 3632	4972	rundll32.exe	83
PID 4972 wrote to memory of 3632	4972	rundll32.exe	83
PID 4972 wrote to memory of 3632	4972	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\39b530c37d033974e91edf653e6583af_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\39b530c37d033974e91edf653e6583af_JaffaCakes118.dll,#1
  2⤵
  PID:3632