9538132f5d782c9adb4ad08cff90238737344f71f3fcfe239d0dfb36d294c26f

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08-07-2024 20:34

Target

2db5458c5a48d5ac8b1037a884267dc1_JaffaCakes118.dll
Size

38KB
MD5

2db5458c5a48d5ac8b1037a884267dc1
SHA1

ea03261c23d309b6e750654389916fc68c58e1e5
SHA256

9538132f5d782c9adb4ad08cff90238737344f71f3fcfe239d0dfb36d294c26f
SHA512

1cedb81852986afb7da8ccd15b5c5c3d75243b6e63faaa656b89425c12a57bfaae2725c1e6f42c3c6e0c0ebe81004949603faaa7cee5a0f9e4e12bd985732722
SSDEEP

768:gt0Dlc9dpTxwYTPnGWawMQMVlqI63e11U/UNcGAlc:tlc9dpTxXTPhawrMjqO11rNcGAlc

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 3136	4804	rundll32.exe	82
PID 4804 wrote to memory of 3136	4804	rundll32.exe	82
PID 4804 wrote to memory of 3136	4804	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2db5458c5a48d5ac8b1037a884267dc1_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2db5458c5a48d5ac8b1037a884267dc1_JaffaCakes118.dll,#1
  2⤵
  PID:3136