ae2758c72d84dbe4977f31829286c666835923a095647591a4dac40ba7f74f77

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 06:25

Target

2f4b5aaf949ca676dddfb031ccc2a491_JaffaCakes118.dll
Size

34KB
MD5

2f4b5aaf949ca676dddfb031ccc2a491
SHA1

8dd7e7d85d388858175bf2ae5d555f614b11f268
SHA256

ae2758c72d84dbe4977f31829286c666835923a095647591a4dac40ba7f74f77
SHA512

437dd9663dd42fcedc25689657a9ad8355482365ffbb163ab34f88bc052d8acf5d149877250b2845fe217743d9e680c59fede35d1bbb3c1ce5188f294a26bebc
SSDEEP

768:i7mRDL0cgngbMzSJOQc7S/DftqqhnP0RROGWN:SmRD7gHzS0d7S/1pMRROGk

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 1712	2236	rundll32.exe	84
PID 2236 wrote to memory of 1712	2236	rundll32.exe	84
PID 2236 wrote to memory of 1712	2236	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f4b5aaf949ca676dddfb031ccc2a491_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f4b5aaf949ca676dddfb031ccc2a491_JaffaCakes118.dll,#1
  2⤵
  PID:1712