1681b053e8b4883baa94735b8be3cac059fd69f9503227a6a6d0e0a317799b35

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 15:57

Target

2fe6d1fc37ff06c96f3e54febc48467b_JaffaCakes118.dll
Size

1.1MB
MD5

2fe6d1fc37ff06c96f3e54febc48467b
SHA1

62f127ac81d36cbe16eb53456948418cedcd5eb3
SHA256

1681b053e8b4883baa94735b8be3cac059fd69f9503227a6a6d0e0a317799b35
SHA512

89b5d5073c443d8b1ea46d9e0200228be775524b3cdf7ee0f62878b781ac9d0ff839144efa15e819b0d25c19c3a6e4799ff2fbfbbf0b7cff766532b58071bdf6
SSDEEP

24576:VpTbj+WlWo6RSDlsx2kSeexlkHxW3pzDfopQ3MViBXfGpJ:fbOIsUkSeqlkRCzDQpaMV+oJ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 876	2180	rundll32.exe	82
PID 2180 wrote to memory of 876	2180	rundll32.exe	82
PID 2180 wrote to memory of 876	2180	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2fe6d1fc37ff06c96f3e54febc48467b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2fe6d1fc37ff06c96f3e54febc48467b_JaffaCakes118.dll,#1
  2⤵
  PID:876