b9dcddf35faf85a85cac3343d31f34eedc94c0f688e4144df24ee19f8bc62c3c

Analysis

max time kernel
132s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 04:11

Target

21099d8981f5f25c1fae4d0df6cfc145_JaffaCakes118.dll
Size

9KB
MD5

21099d8981f5f25c1fae4d0df6cfc145
SHA1

59b187cc8753f746a7eaa65734f70572d9f2560b
SHA256

b9dcddf35faf85a85cac3343d31f34eedc94c0f688e4144df24ee19f8bc62c3c
SHA512

2a398e11af73aea685e14a364e4397a37c28f09f2a1944bf8f7cf57b3f3789757b978117d74128c730b74ece4736a0da49aad416ab9ef60e096608bb079fad6c
SSDEEP

192:OkvWoICOdO0XFyl1eh6IG+RTYpdIhwthzB:OQOdOuFgerRTY7IhOhzB

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 968	2552	rundll32.exe	82
PID 2552 wrote to memory of 968	2552	rundll32.exe	82
PID 2552 wrote to memory of 968	2552	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\21099d8981f5f25c1fae4d0df6cfc145_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\21099d8981f5f25c1fae4d0df6cfc145_JaffaCakes118.dll,#1
  2⤵
  PID:968