443bd78057b8d2f87cb1015485ab446793e051703665964fe6c86f41b8ba6c54

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08-07-2024 12:40

Target

2c61154ce27736c00146b7f142e913c9_JaffaCakes118.dll
Size

340KB
MD5

2c61154ce27736c00146b7f142e913c9
SHA1

d441a2720f01f62e87d3582d2cafc4107cf50e4c
SHA256

443bd78057b8d2f87cb1015485ab446793e051703665964fe6c86f41b8ba6c54
SHA512

11e19fc567f7b0459354d1549ac30ad671a75e53c5933c1a674e9f2363d80e79613f6ad9608180905d3c85483d1438e572bc33c47c3181b4c2e0525581e6c04f
SSDEEP

3072:tvA1p08RqEQAIVEd2gG/vNlo0JFx/pANyCm0PQEKR/JnXHWP:t206xWgGxLxWN40PDKR/JnX2P

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 2248	2276	rundll32.exe	82
PID 2276 wrote to memory of 2248	2276	rundll32.exe	82
PID 2276 wrote to memory of 2248	2276	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c61154ce27736c00146b7f142e913c9_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c61154ce27736c00146b7f142e913c9_JaffaCakes118.dll,#1
  2⤵
  PID:2248