26bcba222058739e6a290edfba8519b7e8224810f34bfb3f557cd9ed5f76bdc3

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08-07-2024 19:27

Target

2d8b745e2a61588e0a79bb83201f6dbf_JaffaCakes118.dll
Size

24KB
MD5

2d8b745e2a61588e0a79bb83201f6dbf
SHA1

11f77bbabe42acd47b85cb633669e888dd2cc6bc
SHA256

26bcba222058739e6a290edfba8519b7e8224810f34bfb3f557cd9ed5f76bdc3
SHA512

c8e6345f6a1cc6416be1610332d3d56e7130169ab041bd98318fdd38570f85b24216845d20bddbdbfb0c058e4eaeaf99cb500ce2f4ee124b02c8064cefde8e82
SSDEEP

192:0dSJolcY9UdzWMruIpjuBBQ6PRQkXMhMNn5WnN7i3khpIo:0dSJolazB7uBBQARQkchI5WRi3+p

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4568 wrote to memory of 2588	4568	rundll32.exe	82
PID 4568 wrote to memory of 2588	4568	rundll32.exe	82
PID 4568 wrote to memory of 2588	4568	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d8b745e2a61588e0a79bb83201f6dbf_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d8b745e2a61588e0a79bb83201f6dbf_JaffaCakes118.dll,#1
  2⤵
  PID:2588