24797b76dba4bd6e3664d33cb8ba1464009656ca0ab2bfc6c555c4dc7f26d410

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
29/04/2024, 07:33

Target
07215ee2231a2424358213b94a84c7d4_JaffaCakes118.dll
Size 605KB
Sample240429-jdztsade52
SHA256 24797b76dba4bd6e3664d33cb8ba1464009656ca0ab2bfc6c555c4dc7f26d410
MD5 07215ee2231a2424358213b94a84c7d4
SHA1 4efe8b02a7794514d685f0a0b3b5478510dca708
SHA512 09a203c0dd6da63385e9afb68420b16145280c77041f41692c7a242e955a8541638d4d4b092e291de843eef6ac1f309145951fdfa5ef077294e6bb20fbecb50f
SSDEEP 12288:Uvnek1pNlCtNghtoYV22y4zFqvfZ+HDNmFjxUQ43+eT6/4pqbxaSLuwbdu:UNDCtyFz2h+HDNmFjz43KH9abKdu
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 3920	4544	rundll32.exe	86
PID 4544 wrote to memory of 3920	4544	rundll32.exe	86
PID 4544 wrote to memory of 3920	4544	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\07215ee2231a2424358213b94a84c7d4_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\07215ee2231a2424358213b94a84c7d4_JaffaCakes118.dll,#1
  2⤵
  PID:3920