91a73c4caf75169caf7fcd46da5923ea91a05aca4d830a1f2c630107664484b6

Analysis

max time kernel
91s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 15:58

Target

2ceff302d5805e876f366f9c4bf20bb0_JaffaCakes118.dll
Size

23KB
MD5

2ceff302d5805e876f366f9c4bf20bb0
SHA1

6bfc2213e2bc2c59e58173ca94935e725cbfcbcd
SHA256

91a73c4caf75169caf7fcd46da5923ea91a05aca4d830a1f2c630107664484b6
SHA512

44967893c59cdd1560a43ba3ac4130d739f297bd60443b20b4c1ea61df386ecd5b8bc1aee4da701d46d9809c188e26c23a90e27256b15eda36251ad706ebfb51
SSDEEP

384:WTimCGXhv0UQ8kNSMY8qfBiK609ZiTTNjKfx+/2oc2AJSvtJcvv9GPjl:WTTXGdYP7BiKBmT1k8ZtJcvv0

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 3992	4556	rundll32.exe	82
PID 4556 wrote to memory of 3992	4556	rundll32.exe	82
PID 4556 wrote to memory of 3992	4556	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ceff302d5805e876f366f9c4bf20bb0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ceff302d5805e876f366f9c4bf20bb0_JaffaCakes118.dll,#1
  2⤵
  PID:3992