0013ae86090ecf18a039857ffa4c71d45918ee995080bee013754e37ac9cbe4a

Analysis

max time kernel
135s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2024, 08:44

Target
16e0b3032519c778f5ef00e44b7b0a0c_JaffaCakes118.dll
Size 1.1MB
Sample240505-knbelsfh43
SHA256 0013ae86090ecf18a039857ffa4c71d45918ee995080bee013754e37ac9cbe4a
MD5 16e0b3032519c778f5ef00e44b7b0a0c
SHA1 f991f39165a1a5798fa427e88abc39c203b289b7
SHA512 bbc30cd73b20d93956bb743551eee1b78e38cb80c79adc2b203dd9c69a4f2a6de6c4836cf4386344b096ba50a86cb48d6347790949ef4fdd7a6416eadd3ec710
SSDEEP 24576:qfCaf/YQGzEGsGoEZXQJZ8mG6iKNYo122piZKHAsFvINnZGw1Pf:xarGJoEGaD6icpQsBINV
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 3388	3012	rundll32.exe	84
PID 3012 wrote to memory of 3388	3012	rundll32.exe	84
PID 3012 wrote to memory of 3388	3012	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\16e0b3032519c778f5ef00e44b7b0a0c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\16e0b3032519c778f5ef00e44b7b0a0c_JaffaCakes118.dll,#1
  2⤵
  PID:3388