4bb54561b4ed416f5e4449d777710d7ea514768dd44a1f23221f731bc7067059

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 22:35

Target
8faca7186e445dcdae65f1cd4fbb408f_JaffaCakes118.dll
Size 81KB
Sample240602-2h63rsaf67
SHA256 4bb54561b4ed416f5e4449d777710d7ea514768dd44a1f23221f731bc7067059
MD5 8faca7186e445dcdae65f1cd4fbb408f
SHA1 34d0a21ab063288348da41322a7aab76218aad42
SHA512 ac8308437e694e92f68460c099bf7ef8c9243a7fc3808de075f06046a974bf903ee2c95b63e3b37a82a94ea398bfc2ab60a3ce2427b8624b7d4a84fe44cb05e9
SSDEEP 1536:b4k4GVCrVqbaiDr1R0bq186Xq23iPL53XOFYV8KLokTVgazTmy2kgSCZiFb7:rCAaCrb0bJ6EP93X5EkTVJXmXo
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3388 wrote to memory of 1488	3388	rundll32.exe	82
PID 3388 wrote to memory of 1488	3388	rundll32.exe	82
PID 3388 wrote to memory of 1488	3388	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8faca7186e445dcdae65f1cd4fbb408f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3388
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8faca7186e445dcdae65f1cd4fbb408f_JaffaCakes118.dll,#1
  2⤵
  PID:1488

memory/1488-0-0x0000000010000000-0x0000000010033000-memory.dmp

Download