2156730ca68ad9a3649a1ec077ed37f80e37ede0ec78add6ac6949ed2bc3a4aa

Analysis

max time kernel
134s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 06:42

Target

38c59a4398c144434f205f0512bee95b_JaffaCakes118.dll
Size

874KB
MD5

38c59a4398c144434f205f0512bee95b
SHA1

7ae4f7cb8e11f73c2b4e7e28d8eb4823952e1c0b
SHA256

2156730ca68ad9a3649a1ec077ed37f80e37ede0ec78add6ac6949ed2bc3a4aa
SHA512

64b3d09e81153eb513dabb232cb2d5b817917279a08e8f30b7702e269e094abd9aa0f33f2edbcf29973d5d3d5d79d51d2481dfac3f0f5ebe35a4dfb70380ad47
SSDEEP

12288:R+u4qdn/5Mo1T+J23BK3GWLsYGGnV+sBmzE/+zbVIGqV/BIBKZBQvFOVT6hUu1xy:R+tCdwpGZ1xtcDNshzSSRtB8boNMkRU

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 4480	2268	rundll32.exe	83
PID 2268 wrote to memory of 4480	2268	rundll32.exe	83
PID 2268 wrote to memory of 4480	2268	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\38c59a4398c144434f205f0512bee95b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\38c59a4398c144434f205f0512bee95b_JaffaCakes118.dll,#1
  2⤵
  PID:4480