91364d23b3a2e022edaa7a2ab5be2cfdaeca33c9c8e5d2ab0311290b6f8fee4c

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 02:43

Target

245d4e7b4b02833109844f2ab85bd4f7_JaffaCakes118.dll
Size

5KB
MD5

245d4e7b4b02833109844f2ab85bd4f7
SHA1

9106cf72a65244e422b7b4ca9ec3caaf3f429a38
SHA256

91364d23b3a2e022edaa7a2ab5be2cfdaeca33c9c8e5d2ab0311290b6f8fee4c
SHA512

c85b9ae98a4c8d1fdfd0a56c35c77d22f901a2166d6f5aa0e153920b40e3ffa5742ce8eae58045d1cc2a55bfbc991aa191153f3d187ccf210107a21b1c6581d8
SSDEEP

96:RnDi6iiGIaXowjJj8KE7milmQ1k6GsvvV0DB5UVMecByM8sd+mIwA6BH:Rn+a1eSK+VSDcmFyy3kI

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 2268	2404	rundll32.exe	82
PID 2404 wrote to memory of 2268	2404	rundll32.exe	82
PID 2404 wrote to memory of 2268	2404	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\245d4e7b4b02833109844f2ab85bd4f7_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\245d4e7b4b02833109844f2ab85bd4f7_JaffaCakes118.dll,#1
  2⤵
  PID:2268