28102e4481a916ee344ecf40e00df1bcb875c76f31a6013b9d4691f926fc51f6

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06-07-2024 11:04

Target

2852db5db80100c7ec8bbe4dc7a8a7ed_JaffaCakes118.dll
Size

128KB
MD5

2852db5db80100c7ec8bbe4dc7a8a7ed
SHA1

1e9edae8823a8d77fb2df1efdd6a8ee38b57c6d7
SHA256

28102e4481a916ee344ecf40e00df1bcb875c76f31a6013b9d4691f926fc51f6
SHA512

35a4599de098e0a8dcd5bf3acb104c1f003be7a20c6d8faefa83ce68d98148d74e1403635ab4ca13ba162e1b895db12cb0e6166343c9e323418078d419a2b87d
SSDEEP

3072:5TYIU9rudTGXjwiHvBQBT5rM9vnQkMlPdscoP14xHhBr3l9+pEsITF8IHabCl5LB:5I4pYqc4o7tyN6Y

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4020 wrote to memory of 4664	4020	rundll32.exe	82
PID 4020 wrote to memory of 4664	4020	rundll32.exe	82
PID 4020 wrote to memory of 4664	4020	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2852db5db80100c7ec8bbe4dc7a8a7ed_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2852db5db80100c7ec8bbe4dc7a8a7ed_JaffaCakes118.dll,#1
  2⤵
  PID:4664