fa7a17fc23fb97f9c81d30532069c18f64aeb53de4a90feb251445d1e0b75a4d

Analysis

max time kernel
94s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 09:52

Target

2be3481523392be25417d28691deb227_JaffaCakes118.dll
Size

17KB
MD5

2be3481523392be25417d28691deb227
SHA1

cfbe6a55e9f3e07e1d01b90a7461f7e0623cb197
SHA256

fa7a17fc23fb97f9c81d30532069c18f64aeb53de4a90feb251445d1e0b75a4d
SHA512

51f9cbac984c8af6c09a788b7e95652de57af07bf49b5a5fe824b208d6fd03f3243276e030aa9a8e33fd992cbd9f7d89636778eaab2b4cede2176bf08902cedb
SSDEEP

192:m7mFbyBrGv9OQMJcSQNzlPHO3aEZ27x5QhuBBQ6PRQkocOYPv9mCG:myF2Mv8QIufO3ybQhuBBQARQkjOYPv

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 4260	5000	rundll32.exe	82
PID 5000 wrote to memory of 4260	5000	rundll32.exe	82
PID 5000 wrote to memory of 4260	5000	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2be3481523392be25417d28691deb227_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2be3481523392be25417d28691deb227_JaffaCakes118.dll,#1
  2⤵
  PID:4260