4fbf2adb132a75222d6f64a248ef420cdfe02e5c58f5d562f0748ff1bbbe0781

Analysis

max time kernel
150s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
07-07-2024 05:31

Target

29c2ca8217fe0ce8eaf312db806e6cb4_JaffaCakes118.dll
Size

340KB
MD5

29c2ca8217fe0ce8eaf312db806e6cb4
SHA1

38cebd8277c283e1768f87e1deb4aa14276541a0
SHA256

4fbf2adb132a75222d6f64a248ef420cdfe02e5c58f5d562f0748ff1bbbe0781
SHA512

d608fe9f529eecc3333f21b74483b3db61e85754c323e044e3910daea51fec63cf078bbef70a4807908d183f3471edc8c4df447f80ba7d008a7998e3465b181d
SSDEEP

3072:9vA1p08RqEQAIVEd2gG/vNlo0JFx/pANyCm0PQEKR/JnXHWP:9206xWgGxLxWN40PDKR/JnX2P

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 4296	2156	rundll32.exe	82
PID 2156 wrote to memory of 4296	2156	rundll32.exe	82
PID 2156 wrote to memory of 4296	2156	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\29c2ca8217fe0ce8eaf312db806e6cb4_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\29c2ca8217fe0ce8eaf312db806e6cb4_JaffaCakes118.dll,#1
  2⤵
  PID:4296