70b247be404aa8fedc494390439ac1dfee44332fcd89c1b1e59f137f224baaa1

Analysis

max time kernel
149s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08-07-2024 00:00

Target

2a43b605e338dde8ab873cdd770355ea_JaffaCakes118.dll
Size

340KB
MD5

2a43b605e338dde8ab873cdd770355ea
SHA1

5d3ce3fb3cb633b70f7d04fc8ab82db065945f81
SHA256

70b247be404aa8fedc494390439ac1dfee44332fcd89c1b1e59f137f224baaa1
SHA512

566c790dcd3f2ad7b8a2d9c6a5a2d109423d70787c212406260525dad39f37730e2b9c3668ee663b84a4f1fbb15a20e0c219284f41979e63b774fba95dd37e32
SSDEEP

3072:fvA1p08RqEQAIVEd2gG/vNlo0JFx/pANyCm0PQEKR/JnXRca:f206xWgGxLxWN40PDKR/JnXya

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5056 wrote to memory of 2396	5056	rundll32.exe	82
PID 5056 wrote to memory of 2396	5056	rundll32.exe	82
PID 5056 wrote to memory of 2396	5056	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a43b605e338dde8ab873cdd770355ea_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a43b605e338dde8ab873cdd770355ea_JaffaCakes118.dll,#1
  2⤵
  PID:2396