dbb913957aeef7e75bcc2c4677dbc549a3a3521acb3318c794c3db3b5acb8049

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 11:01

Target
918997cf338a148b45ace89364921776_JaffaCakes118.dll
Size 1.1MB
Sample240603-m4spyade46
SHA256 dbb913957aeef7e75bcc2c4677dbc549a3a3521acb3318c794c3db3b5acb8049
MD5 918997cf338a148b45ace89364921776
SHA1 0c58afa5dde5750576ef884a5fce8f37f7fb1739
SHA512 8a554c918fdd218fd0b0ee0063ce2bc04e5e5079d159c7303ac6b159c7d0072cd874182582aaad33376df511516660fd7d0aa425987ed70d4d212ad85d873829
SSDEEP 12288:oHktCtq/O5N4VQTbDZ8MQ7pODZAV/3M56GeRLAQ4t5ND/J3mIJeimUgSRFtHa7W:oEtb/oN1C7wZANPRLcR3tJeimUJHaa
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5056 wrote to memory of 1616	5056	rundll32.exe	82
PID 5056 wrote to memory of 1616	5056	rundll32.exe	82
PID 5056 wrote to memory of 1616	5056	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\918997cf338a148b45ace89364921776_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\918997cf338a148b45ace89364921776_JaffaCakes118.dll,#1
  2⤵
  PID:1616