216a55aeefae1b95d28e6eb87a7bc24443895307eb6afd2639998e1a932a063b

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 03:08

Target
3daa04539bbd6e943b4822618bd5c3f3_JaffaCakes118.dll
Size 1.0MB
Sample240514-dm3n5sha53
SHA256 216a55aeefae1b95d28e6eb87a7bc24443895307eb6afd2639998e1a932a063b
MD5 3daa04539bbd6e943b4822618bd5c3f3
SHA1 21609547b6125b88822e1d419596b164e4fb602f
SHA512 ad258a989622206b517313e2fd86223d09f9e6379f5ec46fc94366c6cbac54268490c85dc4ce989af7aeb6196404cf472ed34273b4a8c113b0cd675c502a6d02
SSDEEP 12288:eDIPXTuAR8T0zakM/pslmuzsGFqTykuzrAFvcg3FIUy9QF5iBhocyhL2KEMo5G8Q:eE/Cc8ehs1GDAagiqcgo3uQIYo
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 372 wrote to memory of 1792	372	rundll32.exe	84
PID 372 wrote to memory of 1792	372	rundll32.exe	84
PID 372 wrote to memory of 1792	372	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3daa04539bbd6e943b4822618bd5c3f3_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:372
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3daa04539bbd6e943b4822618bd5c3f3_JaffaCakes118.dll,#1
  2⤵
  PID:1792