96f5d1e5b141b64c3ae9d594725b50e33fc328ea7081d0caabdc00a3432341ab

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 03:56

Target

2ae4f38aaef3c7b67550fc43b8daa038_JaffaCakes118.dll
Size

51KB
MD5

2ae4f38aaef3c7b67550fc43b8daa038
SHA1

0804005fbfc0022a2d6c83e1c612c9c3b56f618a
SHA256

96f5d1e5b141b64c3ae9d594725b50e33fc328ea7081d0caabdc00a3432341ab
SHA512

15b097a6172ea5eea3df3b6e4777b4b97146c05eac696cd618152b85ff37b658d24ce4b93fb006ebe09b40dec495b0d2be33148b4a705d2f5afce692adc26ede
SSDEEP

768:SQXX1NLlbizsU9t0S6B8LbRJlk7eeSpeqz4FFj501Zn:SufYt0S6B8ZkQeyYFGn

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 2216	2492	rundll32.exe	80
PID 2492 wrote to memory of 2216	2492	rundll32.exe	80
PID 2492 wrote to memory of 2216	2492	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ae4f38aaef3c7b67550fc43b8daa038_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ae4f38aaef3c7b67550fc43b8daa038_JaffaCakes118.dll,#1
  2⤵
  PID:2216