959ae65f112549cffab3378d8c87473c9db0cd32ca4b2006ae720c1ae6851428

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 18:17

Target

2925c4782fa073fee743337e6a5bb67d_JaffaCakes118.dll
Size

36KB
MD5

2925c4782fa073fee743337e6a5bb67d
SHA1

92390a9e90262d48d83800d1e3fc47f8e71b0cfe
SHA256

959ae65f112549cffab3378d8c87473c9db0cd32ca4b2006ae720c1ae6851428
SHA512

91f2bcd7d652ff4c9ef85a812d9e041e5ac4e974d3d21679898f699de7751776df583bcedc3340d79bf16d5f4eecdb44c2f51cffa66c004d702481a18a118544
SSDEEP

384:hd3LAWamUtPahaXAxf+me/Q3iyVLeabYXmue2W2LvhoOp5xMLc2B9Ief8JUrhSX:j38tJtCzKgiUpoWkodAm8JUsX

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 2940	1440	rundll32.exe	85
PID 1440 wrote to memory of 2940	1440	rundll32.exe	85
PID 1440 wrote to memory of 2940	1440	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2925c4782fa073fee743337e6a5bb67d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2925c4782fa073fee743337e6a5bb67d_JaffaCakes118.dll,#1
  2⤵
  PID:2940