ec0cec7dd5ba1ad91cc4c916aa0d69390315f81bfc2ef64806111a5378dc491c

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 19:54

Target
3eaabf78d3dc948134cd488bfb817d33_JaffaCakes118.dll
Size 28KB
Sample240712-yml2lsxgnp
SHA256 ec0cec7dd5ba1ad91cc4c916aa0d69390315f81bfc2ef64806111a5378dc491c
MD5 3eaabf78d3dc948134cd488bfb817d33
SHA1 7ecaf517496c754dc542a23ccdace037fad76eb7
SHA512 4182a4bbfc3cef9d7baf7b81890e10c563de556783ff393ccee6a517a71f5a72d69a8f0ea4fc3a3aa1305e714888d8674060a4f6fc8a7f5c164c32c08e4d51ce
SSDEEP 768:xANs5EubOjhAsEvxIkH30eOtygLb37HS:xANseubOj6RIkXpOtXLjrS
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 1052	3028	rundll32.exe	83
PID 3028 wrote to memory of 1052	3028	rundll32.exe	83
PID 3028 wrote to memory of 1052	3028	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3eaabf78d3dc948134cd488bfb817d33_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3eaabf78d3dc948134cd488bfb817d33_JaffaCakes118.dll,#1
  2⤵
  PID:1052