8caef38bf4737df91a10c3be8b7e59c14af5676179a19f6199881405eea4127d

Analysis

max time kernel
93s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08-07-2024 12:04

Target

2c463ff682cedc7bdfe167a7da8cc180_JaffaCakes118.dll
Size

340KB
MD5

2c463ff682cedc7bdfe167a7da8cc180
SHA1

9f1f314d03c42680fe2ca97bcb34c4451dd7fc02
SHA256

8caef38bf4737df91a10c3be8b7e59c14af5676179a19f6199881405eea4127d
SHA512

a36ba552e8c5879661d712613476997ae07d801205dc102f4a91c746e6b9f3fd66b5da01c4e53f61f86ac2059a42aab04643aa558550821fac75ecfcfb3e5b7b
SSDEEP

3072:gvA1p08RqEQAIVEd2gG/vNlo0JFx/pANyCm0PQEKR/JnXHWP:g206xWgGxLxWN40PDKR/JnX2P

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3208 wrote to memory of 3584	3208	rundll32.exe	82
PID 3208 wrote to memory of 3584	3208	rundll32.exe	82
PID 3208 wrote to memory of 3584	3208	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c463ff682cedc7bdfe167a7da8cc180_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3208
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c463ff682cedc7bdfe167a7da8cc180_JaffaCakes118.dll,#1
  2⤵
  PID:3584