9aa35340ce4d33553b3acbb03848956f80f92541087eef8a4f34c842708998e3

Analysis

max time kernel
66s
max time network
54s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 14:06

Target
036a46b50e06adf3943ec61e66999028_JaffaCakes118.dll
Size 1.1MB
Sample240427-relybabh55
SHA256 9aa35340ce4d33553b3acbb03848956f80f92541087eef8a4f34c842708998e3
MD5 036a46b50e06adf3943ec61e66999028
SHA1 7c6d06fafca0134dc798f8095e5cf8efba3530e0
SHA512 48bd00be8953e0d53d0ef6d60b134a6a8e41d236f1e24fa15042eeb0b5546ea251d97ebd4992a1224465a55756806915f117d9053c618b495557373bdeed4b61
SSDEEP 24576:jL/g0FIWBpMsTAhaVRwco6A5QyBSO4kpqd:A0l2kbk4Obo
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1248 wrote to memory of 4224	1248	rundll32.exe	85
PID 1248 wrote to memory of 4224	1248	rundll32.exe	85
PID 1248 wrote to memory of 4224	1248	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\036a46b50e06adf3943ec61e66999028_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\036a46b50e06adf3943ec61e66999028_JaffaCakes118.dll,#1
  2⤵
  PID:4224