2057816c4170fa3cef69ba4751fdfa5b28f0deb2604e7aea4598576c5a23c454

Analysis

max time kernel
140s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 10:19

Target
297f3beb9c3b749637a4d519029e196f_JaffaCakes118.dll
Size 1.1MB
Sample240509-mcs7dscf7y
SHA256 2057816c4170fa3cef69ba4751fdfa5b28f0deb2604e7aea4598576c5a23c454
MD5 297f3beb9c3b749637a4d519029e196f
SHA1 b8bdc52e9bf3efb86ceae2e055705b759d07a988
SHA512 5f3d70825ce4c69e27f6c469795e3886389c5775e176eb8b40e5219487e5a9841b81c8c2b0f7a0aa08c67313f01ad7e3d0533c95018b7a1a682c2ac110c98bba
SSDEEP 24576:eUxnFN+kYwA7HZvzpTetpJssJTe0EAey8KXLJfjiR2INK3S:Dn5YwK9tOJ99KyBjitV
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3312 wrote to memory of 2936	3312	rundll32.exe	82
PID 3312 wrote to memory of 2936	3312	rundll32.exe	82
PID 3312 wrote to memory of 2936	3312	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\297f3beb9c3b749637a4d519029e196f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3312
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\297f3beb9c3b749637a4d519029e196f_JaffaCakes118.dll,#1
  2⤵
  PID:2936