578e06e14927d84e5c6ee4cb70a2a851e279be3b840d2977b7e2d4cd380f0ff9

Analysis

max time kernel
94s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
09-07-2024 23:31

Target

326e453bae08be77b6d076a10a029aa4_JaffaCakes118.dll
Size

340KB
MD5

326e453bae08be77b6d076a10a029aa4
SHA1

b06c6c6d07d825357db133829d6cf6d615e099b5
SHA256

578e06e14927d84e5c6ee4cb70a2a851e279be3b840d2977b7e2d4cd380f0ff9
SHA512

87bebad68210fcd254de9dd0a123d48c2b6f322e331e0cc80253aa7549a43bc1b4ceb4cb504c669b19f7f363d58caad53e8912a0ca1237d50bd31f63146efbd5
SSDEEP

3072:SvA1p08RqEQAIVEd2gG/vNlo0JFx/pANyCm0PQEKR/JnXHWP:S206xWgGxLxWN40PDKR/JnX2P

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 2836	2632	rundll32.exe	83
PID 2632 wrote to memory of 2836	2632	rundll32.exe	83
PID 2632 wrote to memory of 2836	2632	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\326e453bae08be77b6d076a10a029aa4_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\326e453bae08be77b6d076a10a029aa4_JaffaCakes118.dll,#1
  2⤵
  PID:2836