2eefd0c040ee1df071e63d9515b9ee24db92a47e6c593cba036089a9dc7d05ec

Analysis

max time kernel
129s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 19:25

Target
142646afedb3de1dbdd244b7d2e3065c_JaffaCakes118.dll
Size 121KB
Sample240504-x5bsxsbc95
SHA256 2eefd0c040ee1df071e63d9515b9ee24db92a47e6c593cba036089a9dc7d05ec
MD5 142646afedb3de1dbdd244b7d2e3065c
SHA1 1450b7f570655a53e184722a92a92a6e7803f419
SHA512 326915f7bff2a86e089a03731201c0ccb2706f99483e963a97f294bbcaab470173fe8a0bea5fa2f60a205e9761b9ccf9c786bd5f253230d0c4b21da634011b00
SSDEEP 3072:AXYTCbZ+jwKESaLrBZLHrdmIRu5dB4klI4gl:eYycLUdjwDLe
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4036 wrote to memory of 3828	4036	rundll32.exe	84
PID 4036 wrote to memory of 3828	4036	rundll32.exe	84
PID 4036 wrote to memory of 3828	4036	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\142646afedb3de1dbdd244b7d2e3065c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\142646afedb3de1dbdd244b7d2e3065c_JaffaCakes118.dll,#1
  2⤵
  PID:3828