bdad82fa2f0af101fb8b881446b9a9e3c416dd0235e1e68c23b5ba0ac592d537

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 00:57

Target

65835b494d91a2fd04eb0ffd9d0d6e63_JaffaCakes118.dll
Size

21KB
MD5

65835b494d91a2fd04eb0ffd9d0d6e63
SHA1

32ab786f99f4572e8b5102f89b8adaf9029d2422
SHA256

bdad82fa2f0af101fb8b881446b9a9e3c416dd0235e1e68c23b5ba0ac592d537
SHA512

bdaee1687d98f2578ce15ae52f0bea749507111e20c863567211121a662099eadce8e3fb65f2dfe7e6842e21e23aa35b3080a9ec2847d7891a3d5706aad742de
SSDEEP

384:AWtS67EEL9BauVzFvt+YvzMYj2+o9oV8zi9sIIT/eHLkqwv/H8WDVwvU0lF2:jaa9kuVpvt+YbMYy+oUGbeHwrXVwvU0G

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5056 wrote to memory of 3436	5056	rundll32.exe	84
PID 5056 wrote to memory of 3436	5056	rundll32.exe	84
PID 5056 wrote to memory of 3436	5056	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\65835b494d91a2fd04eb0ffd9d0d6e63_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\65835b494d91a2fd04eb0ffd9d0d6e63_JaffaCakes118.dll,#1
  2⤵
  PID:3436