b0de8d3b90e53a9070993f5cc0cd9cdea18ee60483b279e484e04e756c624772

Analysis

max time kernel
95s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 04:01

Target

3bea740cc41f5b7908aed6012f2b2971_JaffaCakes118.dll
Size

14KB
MD5

3bea740cc41f5b7908aed6012f2b2971
SHA1

b5becd90b49aac1e2e564f6831a49370cbe9b7bb
SHA256

b0de8d3b90e53a9070993f5cc0cd9cdea18ee60483b279e484e04e756c624772
SHA512

cfb1a10866eda9ffd1368b12390ecd20417343dbbd2e4b8f3c91b84d6e5794dfa7973fcf3a3a043c046613d40885d2edea4f1181fe85f6b29a49bea7811998ce
SSDEEP

192:cFp/KIgWPwkEIo3UXNBM2UqWsH3UXT4PuBBQ6PRQkOgAIjm8QXt:cFlK0Pq3CBxXUEPuBBQARQkmIjmj

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 2912	5040	rundll32.exe	84
PID 5040 wrote to memory of 2912	5040	rundll32.exe	84
PID 5040 wrote to memory of 2912	5040	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3bea740cc41f5b7908aed6012f2b2971_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3bea740cc41f5b7908aed6012f2b2971_JaffaCakes118.dll,#1
  2⤵
  PID:2912