8e2d347213576a7c2f1a398013a62ade61bd001e9d1a1535e33f5fc810344638

Analysis

max time kernel
92s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2024, 08:09

Target

ea9fddbb29d9fde653f387b782bf42f5_JaffaCakes118.dll
Size

70KB
MD5

ea9fddbb29d9fde653f387b782bf42f5
SHA1

d11525218e35067ccf5d426c01cf323253d29dcf
SHA256

8e2d347213576a7c2f1a398013a62ade61bd001e9d1a1535e33f5fc810344638
SHA512

9399ac830779bcae1d9dd6e7795f65681ab37c9754685e55236ca7188a2e6bdea86048329ce57843c592c40449f4ef78d4cbee7f4bce699a766ad410d2b3a30e
SSDEEP

1536:WrRQtfuQCsB9wSuiRHmIL3eoMLQt1aWgDa2cOf94bMg2BzUT:ykm+GdiRHmI6oM21aFDa3Of9Q2BS

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 2896	5068	rundll32.exe	85
PID 5068 wrote to memory of 2896	5068	rundll32.exe	85
PID 5068 wrote to memory of 2896	5068	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ea9fddbb29d9fde653f387b782bf42f5_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ea9fddbb29d9fde653f387b782bf42f5_JaffaCakes118.dll,#1
  2⤵
  PID:2896