595e1ded8fba0410a193965849129c3b490fb22b5ff7f20baed30e896c177299

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 21:17

Target

2dd5016a3c414f3b58c95233dbe70f0d_JaffaCakes118.dll
Size

245KB
MD5

2dd5016a3c414f3b58c95233dbe70f0d
SHA1

967cea8cbdb9e76076b09b6aceded5f7cb4ed352
SHA256

595e1ded8fba0410a193965849129c3b490fb22b5ff7f20baed30e896c177299
SHA512

370a58536148e6438d597a8bf423bd3c6234d30e7399e55e198dc10b1ac53959331308300536e176c80076914146ecbd2af8733b866255de0c032e5818b653b8
SSDEEP

6144:c1z0udGmilo5qfOjtxn+ZSCAzQoamt8qmVNhV0NBvba0EPH:TEn6A0oamt8qC0v

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 3748	1128	rundll32.exe	82
PID 1128 wrote to memory of 3748	1128	rundll32.exe	82
PID 1128 wrote to memory of 3748	1128	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2dd5016a3c414f3b58c95233dbe70f0d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2dd5016a3c414f3b58c95233dbe70f0d_JaffaCakes118.dll,#1
  2⤵
  PID:3748