15e1d52d39dd59eb76d7baf45ab7b430c8f807ab5d5a6757757cd45075a00429

Analysis

max time kernel
51s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 14:32

Target
a100640e28020c6704cac0c103c5669f_JaffaCakes118.dll
Size 840KB
Sample240612-rwewbssbql
SHA256 15e1d52d39dd59eb76d7baf45ab7b430c8f807ab5d5a6757757cd45075a00429
MD5 a100640e28020c6704cac0c103c5669f
SHA1 e08ff7e662c30f0055d22575def02392893a9abc
SHA512 38b77b8701ce090d74af1e90ed4c713e9c9f52ca9903c64097f0cbcf085f87f5eb65904e2e76869f354b708270cca8a8c65ca8bf3d8c101dff17e49a2ff3e710
SSDEEP 12288:+C1rDKmuBVg020xLmjmXQyQxJGHdLoahqLX4eSLRtRsLy2:+CFKBVu0xagQnGCrZPx
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 5060	4732	rundll32.exe	81
PID 4732 wrote to memory of 5060	4732	rundll32.exe	81
PID 4732 wrote to memory of 5060	4732	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a100640e28020c6704cac0c103c5669f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a100640e28020c6704cac0c103c5669f_JaffaCakes118.dll,#1
  2⤵
  PID:5060