9d10f3830527638dc6518cdc2a5adc2d91aea512d507939678b04c312078b25c

Analysis

max time kernel
132s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 11:11

Target
2067f3df259b6aac08bf1e755b265edd_JaffaCakes118.dll
Size 1.0MB
Sample240507-namghadd2v
SHA256 9d10f3830527638dc6518cdc2a5adc2d91aea512d507939678b04c312078b25c
MD5 2067f3df259b6aac08bf1e755b265edd
SHA1 980a051823ac621f41b68db42aaa98ea4c1dd108
SHA512 acb1a497c0efc0cd5a99a6784b10d1b306bb4d30cd5cb1661529d1d76e236e2590962a7e0df917967b9d7194b8f353554e1a150c5d0411059ba37ba86e3880f8
SSDEEP 24576:QxCjV8F383ji1dSUxhXTXPbFbGPEOsQUVRkUIpg:cn3Oji1xXTlcsQUVRKpg
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3928 wrote to memory of 3920	3928	rundll32.exe	83
PID 3928 wrote to memory of 3920	3928	rundll32.exe	83
PID 3928 wrote to memory of 3920	3928	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2067f3df259b6aac08bf1e755b265edd_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3928
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2067f3df259b6aac08bf1e755b265edd_JaffaCakes118.dll,#1
  2⤵
  PID:3920