9c486ff02252674d180086e51345bb0150ed582d07ad6167c00999ffce4a8688

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 08:08

Target
a48e69f8442e0d6eff465a25af7da363_JaffaCakes118.dll
Size 33KB
Sample240613-j1rfxsvamn
SHA256 9c486ff02252674d180086e51345bb0150ed582d07ad6167c00999ffce4a8688
MD5 a48e69f8442e0d6eff465a25af7da363
SHA1 7ad4f6abe39d350c2b792a67fb69f81351de73fd
SHA512 7bf3c33d2419927fc99790b51afdd4cdd5105424f7bd68c765e69f4cca7d7c2249391c90520be43dbb5ea0adc56c5780fcbfddb10e01657fa79c0de6047f8bcc
SSDEEP 768:ekR0DJnui6UFGbTmLlvLZlaaauVd27yF:NR0hHsbK9LZY/Q27y
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1004 wrote to memory of 1216	1004	rundll32.exe	81
PID 1004 wrote to memory of 1216	1004	rundll32.exe	81
PID 1004 wrote to memory of 1216	1004	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a48e69f8442e0d6eff465a25af7da363_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a48e69f8442e0d6eff465a25af7da363_JaffaCakes118.dll,#1
  2⤵
  PID:1216