29f140fc41ceb2cd56d3ddf5d29e97628398c3e9080dc81a4056705a006b5cbb

Analysis

max time kernel
94s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08-07-2024 12:09

Target

2c4ada2b6789145e12cc2a855c96a7a1_JaffaCakes118.dll
Size

340KB
MD5

2c4ada2b6789145e12cc2a855c96a7a1
SHA1

b1922f07579002b9fb02d93aef84c7c4a0be9d45
SHA256

29f140fc41ceb2cd56d3ddf5d29e97628398c3e9080dc81a4056705a006b5cbb
SHA512

fa5f73e851a00fb173510be51affaffedb85b1d590c1a0ac894737ef1ba5a5fc3fd1f2f776c3ceed012992f18670565e75688675b3c270366932fda441d0d00b
SSDEEP

3072:7vA1p08RqEQAIVEd2gG/vNlo0JFx/pANyCm0PQEKR/JnXRca:7206xWgGxLxWN40PDKR/JnXya

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 3832	4376	rundll32.exe	82
PID 4376 wrote to memory of 3832	4376	rundll32.exe	82
PID 4376 wrote to memory of 3832	4376	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c4ada2b6789145e12cc2a855c96a7a1_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c4ada2b6789145e12cc2a855c96a7a1_JaffaCakes118.dll,#1
  2⤵
  PID:3832