a8ae44ece93f7ea245e7c48e962f5ee81c085957bcd60c9cb50903f59e48c0e6

Analysis

max time kernel
32s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 11:27

Target

348748cfcf1a69a2385282cb1fdc4b06_JaffaCakes118.dll
Size

139KB
MD5

348748cfcf1a69a2385282cb1fdc4b06
SHA1

b5a17f11537173ef5292e91499ba1755d7fc4380
SHA256

a8ae44ece93f7ea245e7c48e962f5ee81c085957bcd60c9cb50903f59e48c0e6
SHA512

2bc6021659db7a3fd5a5af1912075754b98249966eef0d91689a5826c8f0d0c01babfe750d2dc9b516a154f63373d4a3637acc665edcdd20f2d05804db6d240d
SSDEEP

3072:O4PSK3WZCn3Uag+LVO/h9LR9nAUtQf6P/NllMc:O4VRkag+cDLrxthtcc

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 4316	4660	rundll32.exe	81
PID 4660 wrote to memory of 4316	4660	rundll32.exe	81
PID 4660 wrote to memory of 4316	4660	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\348748cfcf1a69a2385282cb1fdc4b06_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\348748cfcf1a69a2385282cb1fdc4b06_JaffaCakes118.dll,#1
  2⤵
  PID:4316