bbb93e7dae59722d59bc07bf63cd54d300afb8b4b430afc2fa9a82845a9bd424

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 05:48

Target

448f49d2507461d7010c06ef622479c5_JaffaCakes118.dll
Size

32KB
MD5

448f49d2507461d7010c06ef622479c5
SHA1

a36d9b079c220cbdac7b7e833efcba11db80b726
SHA256

bbb93e7dae59722d59bc07bf63cd54d300afb8b4b430afc2fa9a82845a9bd424
SHA512

20ee569fcb28798842d6ea4ece1cbec964e22bda8cfc5b08b8464526aeac475989e8322ee8fa7b9a5e259024239d164eadc00b5f4724a5cfa1ac1ffd7f00e047
SSDEEP

384:/0Jxhmh9NfNryPX6lVf/XTXAcO2jGYVfm50ApXzDar77y4gkSTt4mt6dyRH+ewLW:cD8LP7fbiYVfxr75LSTGm4dA5S6RECyo

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3396 wrote to memory of 5060	3396	rundll32.exe	83
PID 3396 wrote to memory of 5060	3396	rundll32.exe	83
PID 3396 wrote to memory of 5060	3396	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\448f49d2507461d7010c06ef622479c5_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3396
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\448f49d2507461d7010c06ef622479c5_JaffaCakes118.dll,#1
  2⤵
  PID:5060