b9cbfb6650c9e595c84534ed6baedf721f8a35462e4b76a11b394ad092486fe8

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 22:33

Target
8fab6f87c08103ea90f7e080ffd13eb2_JaffaCakes118.dll
Size 712KB
Sample240602-2g1vcsaf34
SHA256 b9cbfb6650c9e595c84534ed6baedf721f8a35462e4b76a11b394ad092486fe8
MD5 8fab6f87c08103ea90f7e080ffd13eb2
SHA1 fa909952026ef051d27f278746c4b21a761bd90e
SHA512 b06295983b198e8d71002f5d84985b88baa26db222a6dd9e084a33831ce7718a41889cb88fdd2f92860a25f55b133c1f7db98a441a17865fdd289d2cf68b3429
SSDEEP 12288:SYdCRC6FC/ul3QGWBDM5kWP2ibBxOLF9YYY6JTxk5cEGOt:SsCC/ulAGODM5zP2ibBxOLF/JTxk8W
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 1676	4764	rundll32.exe	83
PID 4764 wrote to memory of 1676	4764	rundll32.exe	83
PID 4764 wrote to memory of 1676	4764	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8fab6f87c08103ea90f7e080ffd13eb2_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8fab6f87c08103ea90f7e080ffd13eb2_JaffaCakes118.dll,#1
  2⤵
  PID:1676