1222a4453a88686d293e92155a76d1c5c32da156dd28ed6966eabdc19641c022

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 10:39

Target

80751e6a5112bd2a2ef2b247e4ccc467_JaffaCakes118.dll
Size

515KB
MD5

80751e6a5112bd2a2ef2b247e4ccc467
SHA1

33bee47e010ebc9818f95b8b90844cb5bef57bd1
SHA256

1222a4453a88686d293e92155a76d1c5c32da156dd28ed6966eabdc19641c022
SHA512

3f1ad878dd158a04ef60e769e405564dc4867515c13103b89c0c72c89d49f5673077ab6f41a7f192ef4219ab3cf8e884cac550f55c5420c5688a6412e07d346f
SSDEEP

12288:WihNf4lu2BpLiPwlUfIKKuioD4LP22dwf4t8EBs:Wi7f4llsQUfIKKuZAP2ia

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1584	2040	rundll32.exe	82
PID 2040 wrote to memory of 1584	2040	rundll32.exe	82
PID 2040 wrote to memory of 1584	2040	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\80751e6a5112bd2a2ef2b247e4ccc467_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\80751e6a5112bd2a2ef2b247e4ccc467_JaffaCakes118.dll,#1
  2⤵
  PID:1584