2f1aaf160e692fc2c496437f6b93502ae9fde2f1223a6189fca4638199b90d3e

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 02:59

Target

023d9e9742a378b55cbd778c66d2e6da_JaffaCakes118.dll
Size

32KB
MD5

023d9e9742a378b55cbd778c66d2e6da
SHA1

9bc221b2545e9103a42ac18c5e199ca8fe683714
SHA256

2f1aaf160e692fc2c496437f6b93502ae9fde2f1223a6189fca4638199b90d3e
SHA512

aee1da53815c8e3017056396ef438b11b598aeac515f7acd68278d5a2172816498d3a39bdfff0c297291e9b4b39c7e2f9e7d48fb6e3faa50578f5b3072ecd777
SSDEEP

768:5bQqCiZHgb+X6glv+CrCgmUSacGo3VBffd6722MDylb0OqOSBRBw:5bhCiZAW6glv+CrCgmUSacGo3VBfQ72u

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 736 wrote to memory of 4704	736	rundll32.exe	83
PID 736 wrote to memory of 4704	736	rundll32.exe	83
PID 736 wrote to memory of 4704	736	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\023d9e9742a378b55cbd778c66d2e6da_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:736
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\023d9e9742a378b55cbd778c66d2e6da_JaffaCakes118.dll,#1
  2⤵
  PID:4704