d318c49782343277170a99f1c028ec9512c2aeaca1af5ea1a0a329946f17cc4f

Analysis

max time kernel
94s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240708-en
resource tags

arch:x64arch:x86image:win10v2004-20240708-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 06:35

Target

2f52378af3aefa9d11a4801c6869e415_JaffaCakes118.dll
Size

31KB
MD5

2f52378af3aefa9d11a4801c6869e415
SHA1

b59f44f034983fa66e56812e1b816ae57f95b2fb
SHA256

d318c49782343277170a99f1c028ec9512c2aeaca1af5ea1a0a329946f17cc4f
SHA512

bd06ad97920181288919a44492270e18661bbeede79378a4ea352841d41a5ea7d7699134c49caeb7a4aab3bd06753a88e664cb660f29d353986c646ab38447ac
SSDEEP

768:n5xQOLlGMJZuQN0r7qHOjGzhqDwR5xSKW:nXQIGguQg7qH2SksR503

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 4992	4728	rundll32.exe	82
PID 4728 wrote to memory of 4992	4728	rundll32.exe	82
PID 4728 wrote to memory of 4992	4728	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f52378af3aefa9d11a4801c6869e415_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f52378af3aefa9d11a4801c6869e415_JaffaCakes118.dll,#1
  2⤵
  PID:4992