89c5c87405f2f39c0b6e3bd0cb941177653f41c0515148a3ac6ee93505704b21

Analysis

max time kernel
143s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 22:09

Target
a6d08a322b32721ca11aaa208f7a5b62_JaffaCakes118.dll
Size 244KB
Sample240613-12vcmssckd
SHA256 89c5c87405f2f39c0b6e3bd0cb941177653f41c0515148a3ac6ee93505704b21
MD5 a6d08a322b32721ca11aaa208f7a5b62
SHA1 b4e21da94dbaee21b162157523df1e7c19166364
SHA512 604537e3e8334f83a3fcb329cc19590a3ba10a7b0471d31f292223d72044de5e2a3341bddac2b24327521f998ed678e362db696308f5da0e2d3a4329f0bd292c
SSDEEP 3072:Yl6GG8nqyssGXe2GsFf3XcLEimaP26yw99z64ocliyxgXZW/f8Y:I6G5nqy5irPV6vO6r9PtIEE
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4392 wrote to memory of 2588	4392	rundll32.exe	83
PID 4392 wrote to memory of 2588	4392	rundll32.exe	83
PID 4392 wrote to memory of 2588	4392	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a6d08a322b32721ca11aaa208f7a5b62_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a6d08a322b32721ca11aaa208f7a5b62_JaffaCakes118.dll,#1
  2⤵
  PID:2588