ab5fc0b13dcfdf21ff4cb458ddf18af030d56c3cc0fe7db4b17f6a3779374953

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 09:22

Target

2bcdac81ecff0ca2382d5d6bf3faae86_JaffaCakes118.dll
Size

76KB
MD5

2bcdac81ecff0ca2382d5d6bf3faae86
SHA1

f2906d423acbe09603a41e793b18be3a828665e1
SHA256

ab5fc0b13dcfdf21ff4cb458ddf18af030d56c3cc0fe7db4b17f6a3779374953
SHA512

06853ed71d7d8de247ecd55cb7b08a88b61bb1a152855084738ae41fd954c8619c03a0d0acc19271cdd587f92b89d43b25a490713dfd7535984908bb0ce45fdc
SSDEEP

1536:dyzJaj6oGDuhmPLTBeKJk9bS0SGbcK9RsMDt11x:dyzJajeDIELNet92nSzDt1

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 2512	2896	rundll32.exe	82
PID 2896 wrote to memory of 2512	2896	rundll32.exe	82
PID 2896 wrote to memory of 2512	2896	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2bcdac81ecff0ca2382d5d6bf3faae86_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2bcdac81ecff0ca2382d5d6bf3faae86_JaffaCakes118.dll,#1
  2⤵
  PID:2512