057557775181556de87e8b457b4ff22227d72aae366e48e8bd79d37a6e1b0e87

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 04:26

Target

9cf9a5c9eb0cfec2f0a34e67d13c8aaf_JaffaCakes118.dll
Size

388KB
MD5

9cf9a5c9eb0cfec2f0a34e67d13c8aaf
SHA1

19b1fa1e75d6652f1f6d21753ef52b3f3db187f3
SHA256

057557775181556de87e8b457b4ff22227d72aae366e48e8bd79d37a6e1b0e87
SHA512

ed82b9bd7c7cec0e0207b396040f4a218de08c101dd0e31629156b966ad7a34bd0408e0b243f1715d2564e9bce31eed84738a6b58a13cf5ebd5c0f29456d79f7
SSDEEP

3072:URLdBzWsg2wx/LuLK4yce91SsFbmsGR/TxczwK/NuZ54mlpVFt0OO4Asi7H4Kw:ILdHsLe/6JxmsGJxc71uLdtNOcCHQ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4724 wrote to memory of 1856	4724	rundll32.exe	81
PID 4724 wrote to memory of 1856	4724	rundll32.exe	81
PID 4724 wrote to memory of 1856	4724	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9cf9a5c9eb0cfec2f0a34e67d13c8aaf_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9cf9a5c9eb0cfec2f0a34e67d13c8aaf_JaffaCakes118.dll,#1
  2⤵
  PID:1856