38ec930d2292676e1b2453494536debe4ef17c3341d59da20ab17c63fb354e9b

Analysis

max time kernel
95s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 01:49

Target

47b7975e6c9f57999739a801a6feadd7_JaffaCakes118.dll
Size

144KB
MD5

47b7975e6c9f57999739a801a6feadd7
SHA1

4158220896361ef6ba2c39ff19c264e7cf1ab67e
SHA256

38ec930d2292676e1b2453494536debe4ef17c3341d59da20ab17c63fb354e9b
SHA512

1f7129622cefd06cb27ffd3ef158611e22a857c5e70549d4f49ca495b415a326ddf54875caafb17acd01f1ae1e7b846aaca361b38ca2b1ba464bb07c93c600fe
SSDEEP

3072:Be7MAdFhl1QJOKNnqTC4d7Yn8YngJJx3+/tS46xXvs:aMACq17YnRUx3Hhv

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3156 wrote to memory of 2424	3156	rundll32.exe	83
PID 3156 wrote to memory of 2424	3156	rundll32.exe	83
PID 3156 wrote to memory of 2424	3156	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\47b7975e6c9f57999739a801a6feadd7_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3156
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\47b7975e6c9f57999739a801a6feadd7_JaffaCakes118.dll,#1
  2⤵
  PID:2424