3e0ee69e45273fc5d7d5302678b5ce08b05dfd64ff0a54e129d5802ec9a0a5d2

Analysis

max time kernel
94s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 04:12

Target

2aeffe86244e532d0ad1dd6afe2f254d_JaffaCakes118.dll
Size

25KB
MD5

2aeffe86244e532d0ad1dd6afe2f254d
SHA1

9190ea3a0b0119f10695a5cdc33dca72dd5b5aad
SHA256

3e0ee69e45273fc5d7d5302678b5ce08b05dfd64ff0a54e129d5802ec9a0a5d2
SHA512

cdb44b4004472fb0a60f79c488f8cb7f21e2da82d6fbe26a8916af7cb12afcf86eec9a5251683653d4524d420b4450a78b2aa166cdce3dcbf1727836aa31ae90
SSDEEP

384:/TVxz0C9Y3qd+12DQygTMiwJgoeoVhf1cmrZU7RvV8aJYOiAPL/a:wC9mqdScQ/TUneqf1nZU7R5YQ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 2528	1868	rundll32.exe	82
PID 1868 wrote to memory of 2528	1868	rundll32.exe	82
PID 1868 wrote to memory of 2528	1868	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2aeffe86244e532d0ad1dd6afe2f254d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2aeffe86244e532d0ad1dd6afe2f254d_JaffaCakes118.dll,#1
  2⤵
  PID:2528