231bc6249ba47406295b348b078ebd1462c19d0b897cb1b2847e45fa792db3a6

Analysis

max time kernel
62s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 00:21

Target
a31e7006d336311f9368748fdf005043_JaffaCakes118.dll
Size 1.0MB
Sample240613-andvmawhph
SHA256 231bc6249ba47406295b348b078ebd1462c19d0b897cb1b2847e45fa792db3a6
MD5 a31e7006d336311f9368748fdf005043
SHA1 872309d26665a4a34fe51e007844057038643977
SHA512 c32b2c2e64fc53abd5ab62f8b5df1bbe545a516408ee8dd3e0face2c4d48d4889095287b137fec4f3ee31d7afd49c801227864e87e33e8ca2ee65facb1ca5086
SSDEEP 24576:zaEPxo6kZxaEkoGm4oforu+pS0+M3tb0pvaep5Zn5YUHO8:lPXUaEwm4vru/0J3tCieDTu8
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 392 wrote to memory of 372	392	rundll32.exe	82
PID 392 wrote to memory of 372	392	rundll32.exe	82
PID 392 wrote to memory of 372	392	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a31e7006d336311f9368748fdf005043_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:392
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a31e7006d336311f9368748fdf005043_JaffaCakes118.dll,#1
  2⤵
  PID:372