e9aa7a3bee8d81f760716947e4335c9cef69bf82e0035183b14ed30183379d89

Analysis

max time kernel
95s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 10:01

Target

2be95249de1ea5acfff7a25d1fa40d38_JaffaCakes118.dll
Size

24KB
MD5

2be95249de1ea5acfff7a25d1fa40d38
SHA1

0c825d6e3e70b46429fb889f2e115b513525ebec
SHA256

e9aa7a3bee8d81f760716947e4335c9cef69bf82e0035183b14ed30183379d89
SHA512

16a4998eb29173009fa1502bded39bd791f17849f88b97d9e2e34f856810899d060186d9f1eeb1b18e82e15795725a6050e2e00d914464b98b7304999a4f7709
SSDEEP

384:efJQ5b433eUMW8a3AF2d/Q7j2u4tkWXpct5C3:efJvZD3Aq+zIkAat5C3

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 904	2700	rundll32.exe	82
PID 2700 wrote to memory of 904	2700	rundll32.exe	82
PID 2700 wrote to memory of 904	2700	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2be95249de1ea5acfff7a25d1fa40d38_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2be95249de1ea5acfff7a25d1fa40d38_JaffaCakes118.dll,#1
  2⤵
  PID:904