fa84ddf26f5e6f3a5b7a2e71a0da4849088f2c6fca6358334d7087d49d7df217

Analysis

max time kernel
51s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 15:36

Target
a12d7e1bf870dcd9d9476869ab8a2d2e_JaffaCakes118.dll
Size 58KB
Sample240612-s2an8stglj
SHA256 fa84ddf26f5e6f3a5b7a2e71a0da4849088f2c6fca6358334d7087d49d7df217
MD5 a12d7e1bf870dcd9d9476869ab8a2d2e
SHA1 8c07479368fb689ad2d4439635d77bc6dbe47dde
SHA512 9cfd1698cd8fe73eb0245e9f85d60a3e5542756457d2aab4776dd047987ca00f687a21532b3bbf591203f414990ff02c83301819e5f8452e195f6bb8aa7d14f0
SSDEEP 1536:pgULBh4te7A/xfx8xCcnWBgZK0L4mn3az+xlqhdh:pBQte7Af8Q6Z7MmnRa
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4068 wrote to memory of 1784	4068	rundll32.exe	81
PID 4068 wrote to memory of 1784	4068	rundll32.exe	81
PID 4068 wrote to memory of 1784	4068	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a12d7e1bf870dcd9d9476869ab8a2d2e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a12d7e1bf870dcd9d9476869ab8a2d2e_JaffaCakes118.dll,#1
  2⤵
  PID:1784

memory/1784-0-0x0000000010000000-0x000000001002C000-memory.dmp

Download