c0eefbc8e6214fee930be7f3614bb17dba52afc3d8085a8ce7c56e3e995fa49a

Analysis

max time kernel
92s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 17:19

Target
2d2e2be000162ab54b2a7c9a0d0728de_JaffaCakes118.dll
Size 346KB
Sample240708-vwcmrazcjk
SHA256 c0eefbc8e6214fee930be7f3614bb17dba52afc3d8085a8ce7c56e3e995fa49a
MD5 2d2e2be000162ab54b2a7c9a0d0728de
SHA1 56705f20f239ded6d0363b71af0d6bc064513c5a
SHA512 465deb29cd0c5738393eb3d0170a39743235d84c8da65ae5ed42439162fbb5eefbf7b75ecfc807627e1f466cd93230a5254e9203ae08030a34e1951a9f730b69
SSDEEP 3072:082jpiC2JG7HZb7XWQml/jz8A4diTE90Q6kF4CKAYRkcj:v2L7HN7Kl/jLA90QECrYRpj
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 2068	632	rundll32.exe	82
PID 632 wrote to memory of 2068	632	rundll32.exe	82
PID 632 wrote to memory of 2068	632	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d2e2be000162ab54b2a7c9a0d0728de_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d2e2be000162ab54b2a7c9a0d0728de_JaffaCakes118.dll,#1
  2⤵
  PID:2068