0b8b2fd6d7e2fdcb40dd2925614a1385d505a66539beca7ca98964c94f0dd3e2

Analysis

max time kernel
93s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08-07-2024 03:06

Target

2ac5a20756d7e72b7f66fe10f5d971be_JaffaCakes118.dll
Size

388KB
MD5

2ac5a20756d7e72b7f66fe10f5d971be
SHA1

bd34ae1c824e0ddc93014f8555a4760a522ab77c
SHA256

0b8b2fd6d7e2fdcb40dd2925614a1385d505a66539beca7ca98964c94f0dd3e2
SHA512

d6611ba11b21c8180511c52d46510a83867c1337322629219fe142450e56becbf491d49c2a2c8d32cb1003d74fe383b6665080bf0d8d56fdce2904d8230ece44
SSDEEP

6144:Fq/MAWU5d1xkFw0wOAzYKZIGMRzxN8zWAxYgFg4m+aWb9J/+mgRh6L1M28TBUVDp:c/MApxkFNQIRxmNrzQh6Zb8Taz

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 4644	1888	rundll32.exe	82
PID 1888 wrote to memory of 4644	1888	rundll32.exe	82
PID 1888 wrote to memory of 4644	1888	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ac5a20756d7e72b7f66fe10f5d971be_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ac5a20756d7e72b7f66fe10f5d971be_JaffaCakes118.dll,#1
  2⤵
  PID:4644