9ac9cc20589cba65f795aaa520fd8211be41511ff7ef1f8efff28399822f7d89

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08-07-2024 00:47

Target

2a649c13129fbf29b9b09f9c8a35b638_JaffaCakes118.dll
Size

94KB
MD5

2a649c13129fbf29b9b09f9c8a35b638
SHA1

80a42e45e3dc3455054ba578df83d3fe296ba49e
SHA256

9ac9cc20589cba65f795aaa520fd8211be41511ff7ef1f8efff28399822f7d89
SHA512

9e355019e0836a6b2931b4deec2ccfa878b277550c066465b76d8a96102554123ad029cb66f6261383193ea87d238f7ea2743c78b0d960176890a0fd60b0652d
SSDEEP

1536:e+oQdim+2XZCAaEJwPxK1pPcP4NP9dSr1K05rWeg:joQDbpEgwPxK1VcANeK2yeg

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4064 wrote to memory of 3508	4064	rundll32.exe	82
PID 4064 wrote to memory of 3508	4064	rundll32.exe	82
PID 4064 wrote to memory of 3508	4064	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a649c13129fbf29b9b09f9c8a35b638_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a649c13129fbf29b9b09f9c8a35b638_JaffaCakes118.dll,#1
  2⤵
  PID:3508