39ea51c763f31a9b2eb491edeb8ea92906d09984975799a09d3adcbbfdd20e0d

Analysis

max time kernel
92s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 03:03

Target

2ec6a3ca7f55c60bf32e9fc611ebd35d_JaffaCakes118.dll
Size

103KB
MD5

2ec6a3ca7f55c60bf32e9fc611ebd35d
SHA1

b6161014efe48329d1e436e083642f6b7c17b6ad
SHA256

39ea51c763f31a9b2eb491edeb8ea92906d09984975799a09d3adcbbfdd20e0d
SHA512

b20109e4dab71657f41fa08081974bb40a0e252fbe84f311dd9c4a06c449ff71be341aa55652374cc82961fc61864adfa4b8fced1a1f5bf569480e56b5ff40b1
SSDEEP

1536:vs+Jc7y1qPHsm8QfLpcILGoka7V2uJp1VcM/vfh7EPeZpIengh31:k+QHsmUul0uJXVb/Xh7EPOpIengh

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 1036	2892	rundll32.exe	82
PID 2892 wrote to memory of 1036	2892	rundll32.exe	82
PID 2892 wrote to memory of 1036	2892	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ec6a3ca7f55c60bf32e9fc611ebd35d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ec6a3ca7f55c60bf32e9fc611ebd35d_JaffaCakes118.dll,#1
  2⤵
  PID:1036