d44e219d859187df535c87b9faba276b73ebd91fd6b9bec2cfb80430930248cc

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240708-en
resource tags

arch:x64arch:x86image:win10v2004-20240708-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 04:28

Target

2efec4e380113d7b66aa5906feb765f7_JaffaCakes118.dll
Size

89KB
MD5

2efec4e380113d7b66aa5906feb765f7
SHA1

d06203d708614668145b98835812e5e310bfee8c
SHA256

d44e219d859187df535c87b9faba276b73ebd91fd6b9bec2cfb80430930248cc
SHA512

6d9d8f506480928fe43b7bada0766bc5013c7af4062f73f263c630829a0cb3eb36934828da0aa43d63c789fb81f9634a1a2d1bfb3c473c19e0ba84391751a360
SSDEEP

1536:ujqjoQH8uxLxVGip+gQSzWvCtvgI59uvwTcic4zL0LWWSNBUJdoZhEx9:totq/ygQkWqtvgg9uvwTjc4zL0LWpNQ5

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 4968	4808	rundll32.exe	82
PID 4808 wrote to memory of 4968	4808	rundll32.exe	82
PID 4808 wrote to memory of 4968	4808	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2efec4e380113d7b66aa5906feb765f7_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2efec4e380113d7b66aa5906feb765f7_JaffaCakes118.dll,#1
  2⤵
  PID:4968