06b0546846029b4c0a194dfc78d5a020073d0b2cce1bbfde65f5ac80d961110e

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 03:53

Target
a3bd978ff042cc136d7d3edb8ae2c37f_JaffaCakes118.dll
Size 840KB
Sample240613-efl89axbkr
SHA256 06b0546846029b4c0a194dfc78d5a020073d0b2cce1bbfde65f5ac80d961110e
MD5 a3bd978ff042cc136d7d3edb8ae2c37f
SHA1 6ebe456b31dd88ee3bee3f87662aae207e77d047
SHA512 f3a33d413da327e57124f105f831e69293ff38988ec31c911aa9fcc2a6118522463d284038789b88dfd3df6a819aa4beee8ffd480db88f78601df6cb2e04052d
SSDEEP 12288:1P4rLXKFmlSQCo/12po7+GmxeSrlArHmLjGmtkwjVemoLvmqE6FDzTtRs5c0:1PmamldCS8o7YeSarH23th7RqHDzKR
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3716 wrote to memory of 624	3716	rundll32.exe	82
PID 3716 wrote to memory of 624	3716	rundll32.exe	82
PID 3716 wrote to memory of 624	3716	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3bd978ff042cc136d7d3edb8ae2c37f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3bd978ff042cc136d7d3edb8ae2c37f_JaffaCakes118.dll,#1
  2⤵
  PID:624